Add your own provider keys, only when you need them

A connection is a credential for one data provider, saved on your computer. The app runs without any, so every card in the tab starts with the badge Optional. Connect a provider for higher limits, or for a feature that has no public route.

The Connections tab also holds two desktop-only MCP sections that are not provider keys: Agents (MCP), a switch that lets an agent such as Claude Desktop read your boards, and MCP servers, a list of other servers whose tools a widget can show. Both start off. Agents and MCP servers explains what each one exposes and runs, and Connect an AI agent shows the setup for Claude Desktop, Claude Code, Codex and Cursor.

A key can also fix a failing portfolio. Public Blockscout hosts can refuse requests that do not come from a browser, so on some networks a watch-only Portfolio fails on its public route. A Blockscout PRO endpoint can fix that for one network, and a Coinbase RPC address keeps the native balance visible. Portfolios lists the networks and how each one is read, and Blockscout says which ones a key can fix.

The tool panel on the left of Cashboard Desktop has four icon tabs: Add, Boards, Style and Connections. Connections is the fourth, drawn as a plug, and its name shows when you hover over it. The tab holds one card per provider, in this order: CoinGecko Demo, Blockscout, Coinbase RPC, Dune, then the two B Cash planner keys, Anthropic key and OpenAI key.

If the tool panel is hidden, press Ctrl \ on Windows or Cmd \ on macOS, or click Show the tool panel at the left of the top bar. In a window narrower than 768 px the panel is a drawer that opens from the menu button at the left of the top bar (named Open dashboard tools), and the key changes nothing you can see. Each card carries a badge: Connected for a value you saved, Preconfigured for one that comes from an environment variable, and Optional when nothing is set.

The web build stores no secrets, so it cannot hold a key. Its Connections tab shows Protected provider connections are configured in Cashboard Desktop. and a Connection guide link that opens the documentation overview, where a short section on keys links to this page. There are no fields to fill in.

On the web, Dune query is dimmed with a Desktop badge and opens a dialog instead of adding the widget. Smart money on Robinhood Chain shows Needs a Blockscout key once you follow a wallet there, and Smart money graph shows the same message in an amber bar, with no way to add a key. The hosted site reads public sources instead: Data sources explains which, and Privacy and data covers what leaves your device.

A CoinGecko Demo key raises the limits on the prices and charts that Cashboard Desktop requests from CoinGecko. The app sends it in a request header to api.coingecko.com, and the card describes it as a way to get higher quote and chart limits. The limits themselves are CoinGecko's, and Cashboard does not document them.

Only CoinGecko quote and chart requests carry the key, the ones behind the widgets in the table above. Other CoinGecko and GeckoTerminal requests, such as the category lists behind Real-world assets and Robinhood stock tokens, carry no key.

If the keyed request fails for any reason, a mistyped or expired key included, Cashboard repeats it without the key. A bad key alone therefore does not stop prices arriving.

Nothing on a widget shows that a key is in use: the Prices source line names CoinGecko with or without one, and a failed keyed request falls back without a message. Test is the one place a wrong key can show up. When checked on 7 October 2026, CoinGecko's ping address answered a made-up key with 401, which Test shows as CoinGecko returned 401, while its price and chart endpoints answered the same made-up key normally.

Only a Demo key is supported. Cashboard has no setting for a Pro key or for CoinGecko's Pro host, and no link for creating a Demo key. You get the key from CoinGecko.

A Blockscout connection points one network's watch-only Portfolio at a PRO or custom endpoint, and its key also switches on Smart money and Smart money graph on Robinhood Chain. The card has three fields: API URL, which is required, API key, which is optional, and Chain, a menu of the 14 EVM networks that is preset to Base. Portfolio and the two Smart money widgets use the saved values in different ways.

Watch-only portfolios: one network

Portfolio in watch mode, and Net worth through it, read an address from Blockscout. The saved API URL and API key replace the public host for the single network selected under Chain. Every other network keeps its public host and gets no key. You can save only one Blockscout connection, so one connection upgrades one network.

For Blockscout's PRO gateway the API URL is https://api.blockscout.com/<chain id>, using the network's chain number: 1 for Ethereum, 8453 for Base and 4663 for Robinhood Chain. A trailing /api or /api/v2 is accepted and ignored. Pick the same network under Chain, because Cashboard does not compare the two. The other chain numbers are in the coverage table.

https://api.blockscout.com/8453

The key travels as the apikey parameter of each Portfolio request for that network, sent to the host in API URL. Cashboard accepts an HTTPS address there, or plain http for localhost and 127.0.0.1. Blockscout issues keys from its developer portal at dev.blockscout.com, and it sets the plans, the limits and the networks its gateway serves. Blockscout covers those and the setup in full.

Smart money: three networks

Smart money on Base, Ethereum and Robinhood Chain uses only the saved key, never the saved URL or chain, and so does Smart money graph. With a key they read https://api.blockscout.com/<chain id> for all three networks. Without one, Base and Ethereum read Blockscout's public hosts, and on desktop the Base host can refuse the app. Robinhood Chain (the Robinhood button in the widget) has no public route in Cashboard, so Smart money shows Needs a Blockscout key with the line Robinhood Chain is read through the Blockscout Pro API. Add a Blockscout key under Connections to follow wallets there. Smart money graph shows that line in an amber bar, above No recent swaps detected.

The form always asks for an API URL, so enter one even when you want the key only for Smart money or Smart money graph. For Robinhood Chain use https://api.blockscout.com/4663 and choose Robinhood Chain under Chain. That URL also takes over Portfolio for the network you pick under Chain, so pick the network you watch most if that matters more to you.

A new key can take a moment to show in a Smart money widget that is already open: the app keeps a result for up to a minute and the widget re-reads every two minutes. Wait a minute, then press the refresh icon at the right end of the row of followed wallets. Smart money graph shares the one-minute result, re-reads every minute and has its own refresh icon at the right of its top row.

Coinbase RPC is a fallback for watch-only EVM portfolios. You save an HTTPS RPC URL and a Chain. The card describes the address as a Coinbase Developer Platform RPC endpoint, and Cashboard has no link for creating one. It does not check that the host belongs to Coinbase; it checks that the endpoint reports the chain you chose. The RPC URL field is masked like a key.

In Cashboard Desktop, Portfolio and Net worth call it in two cases only: Blockscout failed for that exact network, or the network has no Blockscout route. BNB Chain and Avalanche C-Chain have none unless you saved a Blockscout address for them. Like Blockscout, one connection covers one network.

What it returns is small: the native coin balance, with no price, no tokens and no total. The source line of the widget then reads Coinbase RPC, and its i button, How to read this widget, says the reading is the native balance only. The web build has no such fallback.

Dune holds your own Dune API key and nothing else. It is what the Dune query widget reads with: without it the widget shows Connect your Dune API key and the steps, because Dune serves query results only to API keys.

Create a key at dune.com/settings/api, which the card also links as Create an API key on dune.com, paste it into API key and press Save. Every open Dune query widget reloads at once.

Cashboard reads only the cached result of a query and never starts a run. Each read spends credits from your Dune plan, and the widget notes that more rows spend more. The Test button reads one row, so it costs credits too. Cashboard cannot tell you what a read costs, so check your Dune plan. Presets, row limits and refresh timing are in the Dune query entry.

Anthropic key and OpenAI key let B Cash plan a desk with your own model account instead of Luna. Each card has one API key field. Choose Anthropic key or OpenAI key in the Planner picker at the top of the B Cash panel to use it. The Anthropic key plans with Claude Opus 5.5 and the OpenAI key with GPT-6 Luna; there is no model picker.

The key stays in the desktop main process and never reaches the board or the renderer. A plan request goes from your computer straight to Anthropic or OpenAI and is billed to your account there, not to your Luna allowance. It carries your message, a board inventory (widget types, titles, public asset ids, frames and links between widgets; no positions, addresses, balances, note text or URLs), and on a board with fresh readings a snapshot of public readings. It never carries wallet or account addresses, balances, note text or URLs. Cashboard allows 6 key requests a minute and waits 45 seconds at most for each.

Test checks the key without planning anything: the Anthropic card reads the Claude Opus 5.5 model, and the OpenAI card lists models. A rejected key shows The Anthropic key was rejected. or The OpenAI key was rejected. These keys work only in Cashboard Desktop; on the web both planner options are disabled and marked Desktop only. Like the other cards, they cannot be saved when only basic text storage is available.

• Cashboard never needs a seed phrase or a private key. A watch-only portfolio reads a public address, and nothing in Connections signs anything.
• Paste a key only into the card of the provider that issued it. There is no card for a broker or an exchange account, and a value in the wrong card is sent to the wrong company.
• Keep the RPC URL private. Cashboard masks the field like a key.
• Keep keys out of boards. A Note, a widget title or a frame label is part of the board, and a share link or an export carries it. Templates and sharing lists what a link removes.

1. 1

   Fill the card

   Open the Connections tab, find the provider and type or paste its fields. Keys and the RPC URL are masked. The fields that must be filled are Demo API key, API URL, RPC URL and the Dune API key; the Blockscout API key may stay empty.

2. 2

   Press Save

   The card shows Saved securely. The value is no longer shown., the fields empty and the badge becomes Connected. A value that fails the rules below shows a red message instead.

3. 3

   Press Test

   The Test button and its messages explains the answers. Test checks what is stored, so save first.

Saving replaces the whole entry for that provider. For Blockscout the URL, key and chain are saved together, so changing one means entering all three again.

You cannot read a saved entry back. The fields are empty after a save. The Chain menu keeps your pick while the tab stays open and returns to Base the next time the tab opens, so it never shows the network you saved. Set it before every save. To see which network a saved Blockscout or Coinbase RPC entry covers, press Test: a success names the saved Chain.

After a save or a clear, Cashboard drops its cached prices and portfolio readings, so Prices, Price chart and Portfolio use the change on their next refresh. Dune query widgets reload at once. No restart is needed. Smart money and Smart money graph are the widgets that can lag, as described under Blockscout.

Test is available once a connection exists, saved or preconfigured. It checks the stored value, not what you have typed, and it gives up after 8 seconds. The result appears as a line at the bottom of the card, green on success and red on failure.

A request that fails before any answer, such as a timeout or no network, shows the system's own error text, or The provider could not be reached. when there is none.

A green line proves less than it looks. Blockscout passes on any successful answer from the stats address, so it does not compare the URL's network with Chain and does not try the other networks Smart money reads. On the PRO gateway it does catch a missing or wrong key: when checked on 7 October 2026, the gateway answered 402 to a request with no key and 401 to a made-up one. A host that ignores the key would pass a wrong one. CoinGecko Demo checks one ping request, which says nothing about the limits your key gives you. For Dune, a 404 from the check query also counts as success. Cashboard reads it as a good key and a query with no saved run, because Dune answered a made-up key with 401 when checked on 7 October 2026.

Cashboard saves your connections as encrypted text in one settings file in the app's data folder, next to your boards, using your operating system's secure storage. Each connection is encrypted on its own. The value never enters a board, so a Share link, an exported board file and a template carry no key.

• Never shown again. After Save the fields empty and the card shows only a badge. To change a value you enter a new one.
• The app window learns only whether a connection is set, whether the value was saved or came from the environment, and whether this computer can save at all. The badge shows the first two. It never receives the value back; the value passes through the field once, on its way to the part of the app that stores it.
• Requests go from your computer straight to the provider, not through a Cashboard server. Each key goes only where its card sends it: the CoinGecko Demo key to api.coingecko.com, the Dune key to api.dune.com, the Blockscout key to the host in API URL (and, for Smart money and Smart money graph, to api.blockscout.com), and the RPC URL to the address you entered.
• Refused without real encryption. When the system offers no secure storage, or only basic text storage, Save is disabled and the card shows Secure operating-system storage is unavailable. Connections preconfigured by your administrator can still be used. Cashboard writes nothing in readable form, and values saved earlier are not used while storage is unavailable.
• A saved value that cannot be decrypted later counts as not configured. The badge reads Optional again, or Preconfigured when an environment value exists, and you save the value again.

• Replace a value: enter the new value in the card and press Save. It replaces the old entry completely.
• Remove a value: press the trash icon, titled Clear saved credentials. It shows only on a card with a saved value, and it acts at once with no confirmation. The card shows Saved credentials cleared. and widgets go back to their public route where one exists. Dune query returns to Connect your Dune API key.
• Fall back: when an environment variable supplies the same connection, the card then reads Preconfigured and that value applies.

Clearing removes the value from this computer only. It does not revoke the key, so when a key may have leaked, revoke or rotate it with the provider as well. Uninstalling Cashboard keeps its data folder, saved connections included, so clear them first when you hand a computer on.

You can preconfigure a connection with environment variables, set in the environment that starts the app or in a .env file in the folder the app starts from. An installed app has no .env file unless you create one, so this route mainly suits developers and administrators. The card then shows Preconfigured. Values are read when the app starts, so restart it after a change.

A network id is one of ethereum, base, arbitrum, robinhood, arc, hyperliquid, bnb, polygon, optimism, avalanche, linea, scroll, zksync or gnosis. A chain variable that is missing, unknown or not an EVM network falls back to base.

A saved value wins over the environment. Clear saved credentials removes only the saved value, and the card then falls back to the environment value when there is one. A saved Blockscout entry replaces all three Blockscout variables for Portfolio. Smart money and Smart money graph are the exception: they use the saved key when there is one and the environment key otherwise, so an environment key still works when the saved entry has no key.

Environment values keep working when secure storage is unavailable, which is why the unavailable-storage message mentions them. They are not checked against the field rules above. A Blockscout key set without CASHBOARD_BLOCKSCOUT_API_URL has no URL to replace, so Portfolio sends it to the public Blockscout host of the configured network, and Test answers Invalid URL.

For problems outside Connections, see Troubleshooting.