Authentication & BYOK

Every request to AI Gateway requires authentication. Vercel provides two methods: API keys and OIDC tokens. You can also bring your own provider credentials to use existing agreements or access private features.

Get authenticated in under a minute:

1. Go to the AI Gateway API Keys page in your Vercel dashboard
2. Click Create key and follow the steps to generate a new API key.
3. Copy the API key and add it to your environment:

export AI_GATEWAY_API_KEY="your_api_key_here"

The AI SDK automatically uses this environment variable for authentication. If you are using a different SDK, you may need to pass the API key manually.

API keys work anywhere, whether it's local development, external servers, or CI pipelines. They never expire unless you revoke them. To create, view, or delete keys, see API keys. To cap how much a key can spend, see API Key Budgets.

When you specify a model id as a plain string, the AI SDK automatically uses the Vercel AI Gateway provider and reads the API key from the AI_GATEWAY_API_KEY environment variable:

import { generateText } from 'ai';
 
export async function GET() {
  const result = await generateText({
    model: 'xai/grok-4.3',
    prompt: 'Why is the sky blue?',
  });
  return Response.json(result);
}

For applications deployed on Vercel, OIDC tokens are automatically available as VERCEL_OIDC_TOKEN. No secrets to manage, no keys to rotate. It just works. See OIDC for setup.

// Automatically uses OIDC on Vercel, falls back to API key locally
const apiKey = process.env.AI_GATEWAY_API_KEY || process.env.VERCEL_OIDC_TOKEN;

BYOK lets you use your own provider credentials. This is useful when you:

• Have existing agreements: Use enterprise pricing or credits from providers
• Need zero markup: BYOK requests have no additional fee
• Require private access: Access provider features that need your own credentials
• Want automatic fallback: If your credentials fail, requests can retry with system credentials

BYOK credentials are configured at the team level and work across all projects. See the BYOK documentation for setup instructions.

• Create an API key in the dashboard
• Set up OIDC for zero-configuration authentication on Vercel
• Set up BYOK to use your provider credentials