{"record":{"id":"9bc9e17033b21099","repo":"vercel/ai","slug":"ai-gateway-authentication-was-selected-but-neithe","errorCode":null,"errorMessage":"AI Gateway authentication was selected, but neither AI_GATEWAY_API_KEY nor VERCEL_OIDC_TOKEN is set.","messagePattern":"AI Gateway authentication was selected, but neither AI_GATEWAY_API_KEY nor VERCEL_OIDC_TOKEN is set\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/harness-acp/src/acp-auth.ts","lineNumber":150,"sourceCode":"  const gateway =\n    compatibility?.type === 'ai-gateway'\n      ? {\n          apiKey: resolveGatewayCredential({\n            env: resolvedEnv,\n            credentialSource: compatibility.credentialSource,\n          }),\n          baseUrl: compatibility.baseUrl,\n        }\n      : getAiGatewayAuthFromEnv({ env: resolvedEnv });\n  const apiKey = gateway.apiKey;\n  if (compatibility == null && mode === 'auto' && apiKey == null) {\n    return {\n      providerAuthentication: { type: 'direct' },\n      env: clientAppEnv,\n    };\n  }\n  if (apiKey == null) {\n    throw new Error(\n      'AI Gateway authentication was selected, but neither AI_GATEWAY_API_KEY nor VERCEL_OIDC_TOKEN is set.',\n    );\n  }\n\n  return {\n    providerAuthentication: {\n      type: 'ai-gateway',\n      env:\n        compatibility?.type === 'ai-gateway'\n          ? compatibility.env\n          : providerAuthentication.gateway.env,\n    },\n    env: {\n      AI_SDK_ACP_GATEWAY_API_KEY: apiKey,\n      AI_SDK_ACP_GATEWAY_BASE_URL: gateway.baseUrl,\n      ...clientAppEnv,\n    },\n  };","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/harness-acp/src/acp-auth.ts#L132-L168","documentation":"resolveACPProviderAuthentication throws this when AI Gateway authentication mode is explicitly selected (or required by the resolved mode) but no gateway credential can be found in the environment. The resolver looks for AI_GATEWAY_API_KEY first and falls back to VERCEL_OIDC_TOKEN; if both are absent it cannot construct an 'ai-gateway' providerAuthentication and refuses to continue. This prevents silently launching an ACP harness whose downstream provider calls would fail authentication.","triggerScenarios":"Calling createACP/createCodexACP/etc. with auth configured for AI Gateway (auth.mode not 'direct' and not auto-with-direct-fallback, or providerAuthentication of type 'ai-gateway') while the process env lacks both AI_GATEWAY_API_KEY and VERCEL_OIDC_TOKEN. Also occurs when compatibility?.type === 'ai-gateway' and resolveGatewayCredential returns null.","commonSituations":"Deploying locally without `vercel env pull`; CI jobs where AI_GATEWAY_API_KEY secret is not configured; running in a non-Vercel environment where VERCEL_OIDC_TOKEN is never injected; typos in the env var name; forgetting to pass an env record containing the key into the harness settings.","solutions":["Set AI_GATEWAY_API_KEY in the environment (e.g. from a Vercel access token) before creating the harness.","Run on Vercel (or attach OIDC) so VERCEL_OIDC_TOKEN is available.","If gateway auth is not needed, switch configuration to direct provider authentication (auth: 'direct' or providerAuthentication { type: 'direct' }).","Verify the env vars are spelled correctly and actually passed into the harness env record, not just the shell."],"exampleFix":"// before\nconst harness = createCodexACP({ auth: 'ai-gateway' }); // throws: no credentials\n// after\nprocess.env.AI_GATEWAY_API_KEY = '<key>'; // or export in shell / CI secrets\nconst harness = createCodexACP({ auth: 'ai-gateway' });","handlingStrategy":"validation","validationCode":"function hasGatewayCredential(env: NodeJS.ProcessEnv): boolean {\n  return env.AI_GATEWAY_API_KEY != null || env.VERCEL_OIDC_TOKEN != null;\n}\nif (!hasGatewayCredential(process.env)) {\n  throw new Error('Set AI_GATEWAY_API_KEY (or run on Vercel for VERCEL_OIDC_TOKEN) before using AI Gateway auth.');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const harness = createCodexACP({ auth: 'ai-gateway' });\n} catch (error) {\n  if (error instanceof Error && error.message.includes('AI Gateway authentication was selected')) {\n    // fall back to direct auth or surface a config error\n  }\n  throw error;\n}","preventionTips":["Run `vercel env pull` locally and configure AI_GATEWAY_API_KEY as a CI secret.","Assert required env vars at process startup before constructing harnesses.","Use direct provider authentication when gateway credentials are not available."],"tags":["authentication","missing-env-var","ai-gateway","configuration"],"backgroundTag":"missing-env-var","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}