Skip to main content
Connect Render so CloudThinker can explain why a deploy failed, read build and runtime logs, check service metrics, and review your Render Postgres and Key Value instances. The connection uses a Render API key, and anything that changes your services (a deploy, an environment-variable update, a new resource) goes through your workspace’s Approvals first.

​
Prerequisites

  • A Render account that can see the workspace you want CloudThinker to investigate.
  • Permission to create an API key on that account.
  • A CloudThinker workspace where you can add connections.

​
Setup

1

Create a Render API key

In the Render Dashboard, open Account Settings → API Keys (direct link) and create a key named cloudthinker.Copy the key right away. Render shows the full value only once.
2

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Render, paste the key into RENDER_API_KEY, and click Connect.Success state: the Render card shows a Connected status.
3

Run the verify prompt

Ask the prompt in Verify the connection in a new chat. Don’t skip this: Render accepts the connection handshake even with a bad key, so a wrong key only shows up when the first request runs.Success state: CloudThinker lists your Render workspaces and services by name.

​
Connection details

​
Required permissions

Render API keys aren’t scoped. A key acts as the account that created it and reaches every workspace and service that account can see.
For least privilege, create the key from an account that belongs only to the workspace CloudThinker should investigate, not from an owner account that sees everything you host.

​
Agent capabilities

Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.
Postgres queries run on Render’s side: Render hosts the server CloudThinker calls (an MCP server, the standard way AI agents call a service’s tools), and it runs the SQL with your API key. CloudThinker never holds database credentials. Because a query is a read, no Rule can switch it off. To keep a database out of reach, create the key from an account that can’t see it.
A deploy ships code to live traffic, and an environment-variable update can restart the service. Read the proposed change in the approval request before you accept it. An environment-variable request lists the full resulting set, values included, so treat that chat as sensitive.

​
Verify the connection

​
Example prompts

​
Troubleshooting

The key is wrong or revoked. Render’s handshake succeeds without a valid key, so the error appears at the first request. Create a new key in Account Settings → API Keys. Then open the connection, click the edit icon on the instance, click Replace… in Edit Instance, paste the key, and click Save and test.
The key’s account isn’t a member of that workspace. Ask CloudThinker to list your Render workspaces to see what the key reaches, then create the key from an account in the right workspace.
The service or database was renamed or deleted, or the name doesn’t match. Ask CloudThinker to list your Render services, then refer to the service by the name in that list.
Render is throttling requests. Wait a minute and retry with a narrower request, such as one service or a shorter log window.
Deploys, environment-variable updates, and new resources go through Approvals, and some wait for a person. Check the chat for a pending approval request and answer it before asking again.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • One-time key display: Render shows the API key in full only at creation, so store it in your password manager before you leave the page.
  • Set a rotation schedule: Render API keys don’t expire, so replace the key on a fixed schedule and revoke the old one.
  • Account-wide reach: because a key reaches every workspace its account can see, revoke it in Render (Account Settings → API Keys, then delete the key) as soon as you delete the connection.

Approvals

Decide which Render changes run on their own and which wait for you

Heroku connection

Connect another app platform with a similar setup