> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Providers

A break glass session needs a network path to the target resource. When
the resource is already reachable, no provider is involved. When the
resource is private, break glass uses a **network provider** to stand up
a temporary, session-scoped path into your customer's environment and
tears it down when the session ends.

You configure providers once, on the **Break Glass** page in your vendor
portal. They apply to every break glass session that needs a tunnel.

## The providers

| Provider              | Use it when                                                                                             | What you configure                                        |
| --------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| **Direct** (built-in) | The target endpoint is already reachable (for example, a Kubernetes cluster with a public API endpoint) | Nothing. Direct is always available and needs no API key. |
| **Tailscale**         | The target is private and you use [Tailscale](https://tailscale.com)                                    | A Tailscale API access key for your tailnet.              |
| **Twingate**          | The target is private and you use [Twingate](https://www.twingate.com)                                  | A Twingate API key and your network subdomain.            |

Direct maps to the "directly reachable" network path; Tailscale and
Twingate are the two tunnel providers for private targets. You only need
to configure a tunnel provider if you'll be reaching resources that
aren't already reachable.

## Direct

Direct is the built-in path for targets that are already reachable from
where your operators connect. There's no tunnel to stand up and nothing
to configure: break glass connects to the resource's own endpoint. Every
vendor has Direct available automatically, and it can't be removed.

You can disable Direct on the Break Glass page if you want to require a
tunnel for every session; re-enable it to allow directly-reachable
sessions again.

## Tailscale

For a private target, break glass stands up a temporary
[Tailscale](https://tailscale.com) subnet router inside your customer's
network so the operator can route to the otherwise-private endpoint for
the life of the session. The router is created with single-use,
ephemeral keys and removed at session end, so it exists only for that
one session.

To configure it, add a Tailscale provider on the Break Glass page and
supply a Tailscale API access key for your tailnet. Break glass uses the
key to provision and later remove the per-session router. Unlike the
per-session router keys, this API access key is a standing credential you
hold; store and rotate it like any other production API key.

<Warning>
  **Comments in your Tailscale policy file are not preserved.** Tailscale
  policy files are written in [HuJSON](https://tailscale.com/kb/1018/acls)
  (JSON that allows comments and trailing commas), but break glass updates
  your tailnet policy as standard JSON. When you set up the Tailscale
  provider with your API access key, any comments in the policy file are
  stripped out. If your policy file contains comments you want to keep,
  back it up before adding the provider.
</Warning>

<Note>
  The per-session router is temporary, but network-level access control
  within your tailnet is governed by your tailnet's own ACLs, which you
  control. Scope your tailnet ACLs to match the access you intend break
  glass sessions to have, the same way you would for any device on your
  tailnet; don't assume the integration confines a session within your
  tailnet on its own.
</Note>

## Twingate

[Twingate](https://www.twingate.com) is the alternative tunnel provider
and plays the same role as Tailscale: break glass stands up a temporary,
session-scoped connector into the private network and removes it at
session end.

To configure it, add a Twingate provider on the Break Glass page and
supply a Twingate API key plus your organization's network subdomain
(your `{network}.twingate.com` tenant). Break glass uses these to
provision and remove the per-session connector.

## Adding and managing providers

On the Break Glass page you can:

* **Add** a Tailscale or Twingate provider by supplying its API key (and,
  for Twingate, your network subdomain). When you add a provider, break
  glass validates the key against the provider's API so you find out
  immediately if it's missing a required scope, rather than at session
  time.
* **Enable or disable** any provider, including the built-in Direct path.
  A disabled provider can't be used to resolve a session. Disabling is
  reversible.
* **Remove** a Tailscale or Twingate provider you no longer use. Direct
  is built-in and can't be removed.

Your provider configuration is stored with your vendor control plane and
persists across portal restarts.

<Note>
  [Border0](https://www.border0.com) as a break glass provider is planned
  but not yet available.
</Note>

## Related

* [How break glass works](/fundamentals/break-glass): where the
  network-path plane fits in the two-plane model.
* [Requesting access](/fundamentals/break-glass/lifecycle): how the
  network path is resolved and torn down per session.
* [Security model](/fundamentals/break-glass/security): the
  session-scoping and teardown guarantees for temporary network paths.