# Connecting providers

How to give Brewless access to your Scaleway projects and your bunny.net account, and what that access allows.


Brewless deploys into accounts you own. You connect them once per organisation, on the **Providers** page of the console.

## Scaleway

You own the Scaleway account and Scaleway bills you directly. Brewless only gets a key that is limited to one project.

Three steps in the Scaleway console, under **IAM**:

1. Create an application, for example `brewless`.
2. Give it a policy that is limited to the one project Brewless may manage, with full access to the services listed in [Scaleway permissions](/reference/scaleway-permissions).
3. Create an API key for that application.

Then paste the access key, the secret key and the project ID on the Providers page.

> [!WARNING]
> Never use your own login or an owner key. A key that is limited to one project keeps everything else in your Scaleway account out of reach.

Access to Domains and DNS is optional: it is only needed when the zone of one of your domains is at Scaleway DNS, which Brewless then manages the same way as a zone at Bunny DNS. See [DNS records](/running/dns-records).

Brewless checks each service with a read-only call when you connect. If one is missing, you hear which, and nothing is saved until the key can reach everything it needs.

The secret key is stored encrypted and never shown again.

## Several Scaleway projects

You can connect more than one Scaleway project, for example your own and one in a client's account. **Connect another project** on the Providers page takes a key of that project and a name you choose, such as "Client production"; without a name it is called what Scaleway calls the project. Connecting a project that is already there replaces its key.

Each application runs in one project. When several are connected you choose it when you create the application; with one it is that one. The choice holds for all of the application's environments and does not change later. Applications made before a second project was connected stay in the project they ran in.

A project that applications with environments run in cannot be revoked: Brewless names those applications. Remove their environments first. Each connected Scaleway project is a cloud account of your plan; replacing a key takes no extra place, and bunny.net does not count. See [Billing](/organisation/billing).

## bunny.net

bunny.net is the edge in front of your application: DNS, CDN and Shield. It is optional. Without it an environment is reached on its Scaleway domain, or through DNS you manage yourself.

Paste the API key from your bunny.net account settings on the Providers page.

> [!WARNING]
> bunny.net has one API key per account, with full access: whoever holds it can change every pull zone and every DNS record in that account. Create a separate bunny.net account for what Brewless manages, and connect that one.

## Revoking access

Revoking a connection removes the key from Brewless. Nothing in your provider account is touched, and the key itself keeps working at the provider until you delete it there:

- **Scaleway**: in the console under IAM, API keys.
- **bunny.net**: reset the key in your account settings.