What causes "not a valid vercel api key" in charmbracelet/crush?

Set apikey to a current Vercel AI Gateway key that starts with 'vck_'.

not a valid vercel api key

Error message

not a valid vercel api key

What it means

Vercel does not validate API keys on its /models endpoint, so the provider validator cannot verify Vercel keys over HTTP. Instead it uses a prefix check: the key must start with 'vck_'. A Vercel-provider key lacking that prefix fails with this error before any network request is made.

Source

Thrown at internal/config/config.go:1011

		headers["anthropic-version"] = "2023-06-01"
	case catwalk.TypeGoogle:
		baseURL, _ := resolver.ResolveValue(c.BaseURL)
		baseURL = cmp.Or(baseURL, "https://generativelanguage.googleapis.com")
		testURL = baseURL + "/v1beta/models?key=" + url.QueryEscape(apiKey)
	case catwalk.TypeBedrock:
		// NOTE: Bedrock has a `/foundation-models` endpoint that we could in
		// theory use, but apparently the authorization is region-specific,
		// so it's not so trivial.
		if strings.HasPrefix(apiKey, "ABSK") { // Bedrock API keys
			return nil
		}
		return errors.New("not a valid bedrock api key")
	case catwalk.TypeVercel:
		// NOTE: Vercel does not validate API keys on the `/models` endpoint.
		if strings.HasPrefix(apiKey, "vck_") { // Vercel API keys
			return nil
		}
		return errors.New("not a valid vercel api key")
	}

	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()

	client := &http.Client{}
	req, err := http.NewRequestWithContext(ctx, "GET", testURL, nil)
	if err != nil {
		return fmt.Errorf("failed to create request for provider %s: %w", c.ID, err)
	}
	for k, v := range headers {
		req.Header.Set(k, v)
	}
	for k, v := range c.ExtraHeaders {
		req.Header.Set(k, v)
	}

	resp, err := client.Do(req)

View on GitHub (pinned to 7944b8e522)

Solutions

Set apikey to a current Vercel AI Gateway key that starts with 'vck_'.
Verify the env var resolves correctly and has no surrounding whitespace or quotes.
If you believe your valid key lacks the prefix, check for a crush update — prefix rules track the provider's current key format.

Example fix

// before
apikey "${VERCEL_TOKEN}" // resolves to an old-style token
// after
apikey "vck_1a2b3c..." // key with the vck_ prefix

Defensive patterns

Strategy: validation

Validate before calling

apiKey := os.Getenv("VERCEL_API_KEY")
if !strings.HasPrefix(strings.TrimSpace(apiKey), "vck_") {
    return fmt.Errorf("vercel key must start with vck_")
}

Try / catch

if err := config.ValidateAPIKey(ctx, providerCfg); err != nil {
    if strings.Contains(err.Error(), "vercel") {
        return fmt.Errorf("regenerate a vck_-prefixed Vercel AI Gateway key: %w", err)
    }
    return err
}

Prevention

Generate current Vercel AI Gateway keys (vck_ prefix) rather than reusing legacy tokens.
Quote env-derived keys carefully in crushrc to avoid whitespace/quote contamination.
Re-validate keys after rotating credentials on the Vercel dashboard.

When it happens

Trigger: Configuring a provider of type vercel whose apikey value does not start with 'vck_' — e.g. pasting a Vercel team/token of a different kind, an env var that resolved to an empty or wrong value, or a copied key that got truncated before the prefix.

Common situations: Using an old-format Vercel token, a deployment token, or an OIDC/other credential in the apikey slot; whitespace or quote-wrapping in crushrc/env; users of Bedrock hitting the sibling 'not a valid bedrock api key' error under the same validator.

Related errors

AI-assisted analysis of charmbracelet/crush@7944b8e522 (2026-08-29). Data as JSON: /api/errors/73d7a2eabe79e6aa. Report an issue: GitHub.