How to route your coding agent spend through AI Gateway

Running several coding agents means several provider keys, invoices, and dashboards. This makes it hard to say what coding agents cost last month or which tool did the spending. Routing every agent through AI Gateway fixes that by giving each one gets a gateway base URL and a shared gateway API key/ Then, requests land on a single endpoint with one budget, one set of request logs, and one bill. The Vercel CLI does the wiring for you, detecting the agents on your machine, provisioning the key, and writing each config file.

After this guide, all of your agentic spend, across your own machine and your team's workspace, is managed and visible in your AI Gateway dashboard. You get transparency, clarity, and control over your team's AI spend.

Copy link to headingPrerequisites

Before you begin, ensure you have:

• Vercel CLI installed and authenticated with vercel login
• A Vercel account and a team you can create AI Gateway API keys in
• At least one supported coding agent installed locally

Copy link to headingHow it works

The CLI does three things in one pass. It creates an AI Gateway API key, which becomes the unit of accounting since every agent shares it. It writes the right base URL for each agent, since the gateway exposes several compatibility surfaces and each harness speaks a different protocol. And it edits each agent's config file in place, preserving formatting and saving a .bak first. Your model picker is untouched.

Copy link to headingRun the setup command

Start with no flags at all. The command asks for everything it needs, and the prompts double as a tour of what is being configured:

vercel ai-gateway coding-agents setup

It walks you through the following, in order:

1. Which agents to configure. The agents already installed on your machine are pre-selected. Deselect anything you want to leave alone.
2. Consent for any agent carrying a pre-flight warning, meaning connecting it could disrupt an existing setup. Declining skips that agent and continues with the rest.
3. Session migration, if you have Claude Desktop or Codex Desktop sessions that would otherwise vanish from the switched provider. Originals are never moved or deleted, only copied.
4. A name for the API key. The prompt suggests something like [<user>'s <device>] Coding Agents. Take it, or name it after the machine. This name is what you will be reading in the request logs later, so make it identifiable.
5. The team that owns the key. This is the team the spend bills to.
6. A spend limit for the key, in US dollars.
7. An expiration for the key.
8. Keychain storage on macOS. Say yes. The key goes into your login Keychain instead of sitting in plaintext config, and the agents read it through a shell export.

The command then prints a summary and the planned changes as a per-file diff, with the key masked. Confirm to write the files. Decline and it writes nothing and never creates a key, so the confirmation step is a safe place to change your mind.

Open a new terminal afterward so the shell exports load, and restart Claude Code so it picks up the new settings.

That is the whole setup. Everything below is for when you want to skip the prompts, script the run, or change a decision you made during it.

Copy link to headingChoose which agents to connect

By default the command configures the agents it detects, meaning the ones whose config directory already exists. To be explicit instead, name each agent with a repeatable --agent flag:

vercel ai-gateway coding-agents setup --agent claude-code --agent codex

The --agent values are claude-code, cline, codex, cursor, hermes, kilo, openclaw, opencode, and pi.

Pass --all to configure every supported agent whether or not it is installed yet, which is useful on a machine you are about to install more coding agents on. Naming an agent explicitly also grants consent for that agent's warnings in a run without prompts, so --agent is the flag to reach for when a detected agent gets skipped with reason requires_consent.

Four agents behave slightly differently and are worth knowing about before you run it:

• Cursor keeps API key settings in its account-synced store, so there is no file to write. The command exports the key and prints the steps to finish in Settings -> Models, including the base URL to paste.
• Cline, Hermes, and OpenClaw cannot start without a model, so they get anthropic/claude-fable-5 as a starting point, which you can change at any time. For Claude Code, Codex, OpenCode, Pi, Kilo Code, and Cursor the command pins no model, so you keep choosing your own inside the agent.

Copy link to headingAnswer the prompts up front with flags

Every prompt has a matching flag, so you can supply the answers in the command instead of typing them. Add --yes to skip the prompts entirely, which turns the run fully non-interactive:

vercel ai-gateway coding-agents setup \
  --scope my-team \
  --name "MacBook Coding Agents" \
  --budget 1000 \
  --refresh-period monthly \
  --expiration 90d \
  --yes

• --refresh-period is the flag most worth being deliberate about, because leaving it off does not give you a monthly cap by default. It gives you a one-time allowance that never refills, which is a different thing than what most people think they are setting up.

Pick the cadence to match how you want the ceiling to behave. A monthly refresh gives each machine a recurring allowance. daily is the tighter choice when you are trying to catch a runaway loop rather than budget for a month, since a stuck agent burns through a daily cap in hours and stops there instead of eating the month.

Budgets are a soft cap checked at the start of each request, so the request that crosses the line still finishes and you never get a truncated response. After that the gateway returns HTTP 402 and rejects further requests on that key until the budget resets or you raise it.

• --include-byok applies to provider keys you already had before AI Gateway, like an Anthropic or OpenAI key with credit on it, that you have added to the gateway. Requests using those keys are billed by that provider rather than by Vercel, so by default they show up in your request logs but do not draw down the budget you set here. Add the flag if you want this budget to cap all agent spend, including the credit you are burning at those providers.

Copy link to headingDecide where the key is stored

Say yes to the Keychain. It is the macOS default, it keeps the key out of your config files, and each agent reads it through a shell export at terminal startup.

• --no-keychain writes the key into the agent config files and your shell startup file instead. That is automatic on non-macOS hosts and the fallback if a Keychain write fails.

vercel ai-gateway coding-agents setup --no-keychain

The risk there is a plaintext key in your shell startup file. If you keep dotfiles in git, that key gets committed the next time you sync, so check whether the file is tracked before you run it. Pair the run with a short --expiration and a --budget so a leaked key stops working on its own and cannot run up an open tab, and use --shell-rc <path> to put the export block in an untracked file that your tracked one sources.

Two caveats either way. Pi always keeps the key in its own auth file, and Cline stores it in its provider config rather than reading it from the shell, so running either means a plaintext key on disk regardless. And the command uses a single Keychain item, so connecting a second team replaces the stored key rather than adding to it.

Copy link to headingPreview before you write

Add --dry-run to see the exact edits without creating a key or touching a file:

vercel ai-gateway coding-agents setup --dry-run

A dry run is the right first move on a machine with an unusual setup, since it surfaces which agents were detected and which config files the command intends to edit before anything is provisioned.

On a Keychain setup the confirmation prompt offers a third option: hand the edits to a coding agent you already have open instead of writing them yourself. The command copies a prompt describing the exact changes to your clipboard, and because the key stays in the Keychain that prompt carries no secret. --apply prompt picks it without asking, and --apply edit is the default that writes the files.

vercel ai-gateway coding-agents setup --apply prompt --scope my-team --yes

The --scope is required whenever you pass --yes, since there is no prompt left to ask which team owns the key. Drop it only if you have already selected a team with vercel switch. Otherwise the run fails with reason missing_scope, reporting that no team was selected for the new key.

Copy link to headingRoll it out across a team

Putting your whole team's AI spend through AI Gateway lets you govern and manage it in one place. To get there, run this setup from an onboarding script so every new machine is configured the same way without anyone doing it by hand.

For onboarding scripts and machine provisioning, combine --yes with --non-interactive to get a single JSON object back instead of human-readable output:

vercel ai-gateway coding-agents setup \
  --scope my-team \
  --budget 1000 \
  --refresh-period monthly \
  --expiration 1y \
  --non-interactive \
  --yes

The --scope here is not optional. Pass it explicitly in a script rather than relying on whatever team the machine happens to be pointed at.

The JSON payload reports which files were configured, which agents were skipped, and a reason code your script can branch on. Treat it as a secret, since a successful run returns the full API key unmasked.

Give every machine its own key rather than sharing one. The dashboard then reads as a list of machines, so you can see who is driving spend, cap one machine, or revoke a single key when a laptop is lost.

Pair that with two ceilings above the individual keys. A team-wide limit caps total spend no matter how many keys exist, and a per-key default makes sure keys created outside this flow still arrive with a limit rather than unlimited:

vercel ai-gateway budgets set team --limit 20000 --refresh-period monthly
vercel ai-gateway budgets defaults set api-key --limit 200

Copy link to headingVerify the traffic is routing through the gateway

Open a new terminal, run a prompt in one of the connected agents, then check that the request arrived:

vercel ai-gateway api-keys inspect <key-id>

Find the ID with vercel ai-gateway api-keys ls. The output shows the key's quota, current spend, alert thresholds, and expiry. A non-zero spend figure is your confirmation that the harness is pointed at the gateway and not still talking to its provider directly.

The AI Gateway dashboard is where the picture gets useful. AI Gateway logs every request, so you can watch latency and token usage, break spend down by model, user, or tag, and track credit balances in one place. The Requests section groups usage by project and by API key alongside a detailed log of every request, and each summary carries request count, average tokens, P75 duration, P75 TTFT, and cost for the time frame you pick.

The API key grouping is the view this whole setup exists to unlock. Because every harness on a machine shares one key, that row answers what coding agents cost you, and the per-request log underneath it tells you which models did the spending.

Copy link to headingRotate the key or switch teams

On a machine that is already set up, running the command again changes nothing. It asks whether you want to reconfigure, and answering no exits successfully with reason already_configured. Because no new key is created, you can safely leave the command in a bootstrap script without piling up unused keys.

To actually make a change:

• --reconfigure runs the full setup again, which is how you rotate the key or move the machine to a different team.
• setup --key <new-key> on a Keychain setup swaps in a rotated or expired key, refreshing the Keychain entry in place without touching any config file.

vercel ai-gateway coding-agents setup \
  --reconfigure \
  --scope my-team \
  --budget 2000 \
  --refresh-period monthly \
  --yes

Copy link to headingNext steps

• Constrain which models agents can reach. Routing rules let you rewrite a request for one model into another, or deny a model outright, at the team level. Rewriting an expensive default down a tier is a spend lever that requires no change on any developer's machine.
• Break spend down further. The Custom Reporting API groups cost and token consumption by model, user, tag, or provider, which is how you get from a per-key total to per-person or per-project attribution.
• Set spend alerts. Keys created with vercel ai-gateway api-keys create accept --alert-thresholds 75,100, so you hear about a cap before it starts rejecting requests.