NetBird Agent Network: Letting AI Agents Reach Internal Systems Without API Keys

WZ-IT operates birdhost. Current hosting starts from €349.90 net/month; setup and service level follow the proposal. Former package prices, location lists and cost comparisons in this dated article describe the previous offer, not current WZ-IT terms. View current service scope.

Anyone letting a development team work with Claude Code or Codex quickly faces the same question: do you create one shared API key for everyone, or one key per person that nobody can keep track of? NetBird Agent Network answers it differently: the agent gets no key, it gets an identity. The real provider key stays server-side, the endpoint is reachable only over the encrypted tunnel, and budget caps plus a model allowlist hang off the same group structure that governs the rest of your network access. This article covers what the feature does, where it stands and what it requires.

Also of interest: NetBird vs Tailscale · NetBird v0.71: IPv6 in the overlay · Reverse proxy and L4 support in NetBird

Table of Contents

• The problem: the shared key
• What Agent Network does technically
• Limits: tokens, budget, models
• The practical case: Claude Code and Codex
• Relationship to an AI gateway
• What it requires
• Data sovereignty: what changes and what does not
• Licence and operating model
• Who this is worth it for
• What this means for birdhost customers
• Conclusion
• Sources

The problem: the shared key

NetBird describes the starting point plainly in its own announcement: if you have ever handed an API key to your whole team just so everyone could use OpenAI or Anthropic, you already know how messy that gets [2].

The mess has several layers. A shared key cannot be revoked without locking everyone out at once. It cannot be attributed to a person when next month's bill looks unusually high. And it travels to places it does not belong: environment variables, CI configurations, the config files of local tools. The alternative, one key per person, only relocates the problem: instead of one uncontrolled key you now have thirty.

There is also a property that sets LLM keys apart from other credentials: they generate ongoing cost. A key left lying around is not only a security problem, it is a cost item with no ceiling.

What Agent Network does technically

Per the documentation, Agent Network is NetBird's access control layer for AI agents and the people who run them [3]. Every agent gets a real identity tied to an identity provider, and policies determine what it can reach: which LLM APIs and AI gateways it may call, and which internal resources it may access [3].

The flow in detail [2]:

1. A private endpoint appears inside your network, given in the documentation as https://mirror.netbird.ai.
2. Teams configure their agents against that endpoint instead of using individual API keys.
3. The endpoint is reachable only when the user is connected to your NetBird network and authenticated through your identity provider. From the public internet it is not accessible [3].
4. The proxy establishes the caller's identity from the tunnel, checks it against your policies and injects the real provider key server-side [2].

The decisive difference from a plain proxy lies in step 3. Reachability does not depend on a secret that can be copied, but on network membership plus authentication. A leaked endpoint name is useless to an attacker who is not on the network.

Limits: tokens, budget, models

Because every LLM request passes through an identity-aware proxy, caps become possible. NetBird names two kinds [2]:

• Token caps: maximum tokens over a fixed time window
• Budget caps: maximum spend in USD over a fixed time window

Both apply per user and per group. The README describes them as hard caps that stop requests once a budget is reached [1].

On top of that comes a model allowlist: a group only reaches the models you approve, and requests for unapproved models are denied with a clear message [2]. That is more than cost control. It is the lever that decides which group may reach an external model at all and which stays confined to a self-operated one.

For traceability, every request records the caller's identity, the provider, the model, tokens and cost [2]. The README adds attribution by identity, group or cost centre [1].

The practical case: Claude Code and Codex

The documentation explicitly names two modes of use: human-in-the-loop tools such as Claude Code and Codex, and fully autonomous workloads on VMs, Mac minis or other infrastructure [3].

One point from the README deserves attention because it costs time during rollout if you do not know it: most of an agent's traffic follows the base URL you hand it, but a few client-side checks call their vendor directly and never reach the proxy [1]. On a network that blocks direct egress, those checks fail even though inference itself works.

For Claude Code, NetBird documents concrete switches: CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK=1 when the agent authenticates with ANTHROPIC_AUTH_TOKEN alone, which is the usual shape when the proxy injects the real provider key, and CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS=1 when the network refuses the connection outright [1].

This is exactly the kind of detail that separates a working rollout from half a day of troubleshooting.

Relationship to an AI gateway

Agent Network and an AI gateway are not competing concepts, they sit at different layers. A gateway handles routing, provider choice, caching and budgets. Agent Network handles who reaches the gateway in the first place.

NetBird makes this explicit: the README names the option of reusing an AI gateway you already run by placing the proxy in front of it. Routing and configuration stay in place, identity is added on top, and API key distribution disappears [1].

For anyone inside our ecosystem: this is where it connects with the AI gateway in Pangolin 1.22. Pangolin brings budgets across six scopes and a broad provider list, NetBird brings the identity and the tunnel in front of it.

What it requires

Three things to settle before deployment.

Your own NetBird installation. NetBird states explicitly in the announcement that Agent Network is self-hosted only for now and has not landed in NetBird Cloud yet [2]. Anyone on NetBird Cloud currently cannot enable the feature.

An identity provider. The documentation names Okta, Microsoft Entra ID and Google as examples [3]. Without an identity provider there is no identity for policies to hang off. If you do not have one, that is the actual groundwork. For that case we run Authentik, Keycloak and Zitadel as dedicated instances at authhost.

Beta awareness. The documentation calls Agent Network a beta and adds that it is stable and already running in production environments [1][3]. That is the vendor's statement. For production use it means: pilot in a bounded group, test the behaviour when a budget is reached and keep a fallback path.

Data sovereignty: what changes and what does not

Precision matters here more than a neat formulation. Agent Network does not keep prompts inside your jurisdiction. If the request goes to OpenAI or Anthropic, the content leaves your jurisdiction as before.

What changes is controllability. The model allowlist lets you define which group may reach which provider at all. A group working with personal data can be confined to a self-operated model while other groups continue using external ones. And because every request is logged with identity, provider and model, where data went is afterwards demonstrable [2].

Without a control point both are statements of intent. With one they are a configuration and a log. For the legal assessment of your specific processing you still need qualified legal advice; this article provides technical context.

Licence and operating model

The NetBird repository is under the BSD 3-Clause licence, except for the directories management/, signal/, relay/ and combined/, which are under the GNU Affero General Public License version 3 [4]. Running NetBird yourself therefore means running AGPLv3 components. That is unproblematic for internal operation; if you redistribute, it belongs in review.

Development continues: the agent-network area of the repository has seen further changes since its first commit at the end of June 2026, most recently access roles and self-service for Agent Network in early September 2026 [5].

Who this is worth it for

Good fit when several people or services use the same LLM providers, when costs need attributing per team, and when an identity provider is already in place. The benefit scales with the number of participants: with three developers a shared key is still manageable, with thirty it is not.

Weaker fit when you use NetBird Cloud and do not want to move to your own instance, when no identity provider exists, or when you would rather not put a beta feature on a critical path.

What this means for birdhost customers

Agent Network requires your own NetBird installation, and that is exactly what we run. Our instance is identical in every tier; what differs is support. In the Germany region Essential costs EUR 99.90 net per month, Business EUR 199.90 and Enterprise EUR 449.90, with EUR 20 more outside Germany. Business and Enterprise additionally include the reverse proxy and a custom domain.

If you want to try Agent Network, talk to us first. It is a beta feature that requires configuration at the identity provider and on the client, and the client switches described above are the kind of thing you set once correctly and then never touch again. NetBird documents the full procedure in its quickstart [6]. That is what we are here for.

The trial runs 7 days. A credit card is required to sign up, and after it expires the trial converts automatically into the chosen paid subscription.

See pricing · Get in touch

Conclusion

Agent Network solves a problem many teams are only now recognising as a problem: AI access organised through shared keys that nobody can attribute or bound. The answer, giving the agent an identity instead of a secret, is the right one, and hanging it off the same group structure as the rest of network access makes it practical.

Two limitations belong in the picture: it is self-hosted only, and the vendor calls it beta. If you run your own instance and have an identity provider, you get a control point that did not exist before. If you have neither, you have other homework first.

birdhost is an independent managed hosting provider and is not affiliated with NetBird GmbH, OpenAI, Anthropic, Okta, Microsoft or Google. "NetBird" is a trademark of its respective holders; WireGuard is a registered trademark of Jason A. Donenfeld. This article provides context on independently operated products for information purposes and does not constitute legal advice.

Sources

• [[1]] netbirdio/netbird · agent-network/README.md – identity per agent, hard budget caps, reusing an existing AI gateway, beta note, Claude Code switches
• [[2]] NetBird Knowledge Hub: "Introducing NetBird Agent Network: Keyless AI Access for People and Agents" (28 June 2026)
• [[3]] NetBird Docs: What is NetBird Agent Network? (identity provider, private endpoint, Claude Code and Codex, beta, self-hosted)
• [[4]] netbirdio/netbird · LICENSE – BSD 3-Clause, except management/, signal/, relay/ and combined/ under AGPLv3
• [[5]] netbirdio/netbird · commit history of the agent-network directory
• [[6]] NetBird Docs: Agent Network quickstart
• birdhost.de – managed NetBird hosting