mOperator needs an AI model to work. You have two options for connecting one:
| AI Gateway (Recommended) | Direct API Key | |
|---|---|---|
| Setup | One Vercel API key | One provider-specific key |
| Switch models | Change an env var | Change code + keys |
| Providers | Anthropic, OpenAI, and more | One at a time |
| Logging | Built-in usage dashboard | Roll your own |
| Best for | Teams, production, flexibility | Quick start, single model |
Pick whichever fits your situation. You can always switch later.
AI Gateway is a proxy that routes your AI requests to any supported model provider. One key gives you access to Claude, GPT-4o, and future models. When a better model comes out, you change one env var — no refactoring, no new API keys, no code changes.
AI_MODEL, or npx eve set --model . No code changes, no second SDK.If you followed the Deploy to Vercel guide, you already have one. If not:
mOperator, set scope to your accountAdd to your .env.local:
AI_GATEWAY_API_KEY=your-vercel-token-here
# AI_MODEL=anthropic/claude-opus-4.8That's it. The default model is claude-sonnet-4-5-20250929. To use OpenAI instead:
AI_GATEWAY_API_KEY=your-vercel-token-here
# AI_MODEL=openai/gpt-5.5Optional overrides:
# AI_GATEWAY_URL=https://ai-gateway.vercel.sh # Default, rarely needs changing
# AI_MODEL=claude-sonnet-4-5-20250929 # Override specific modelNot supported any more, and worth explaining rather than leaving you to discover
it.
ANTHROPIC_API_KEY and OPENAI_API_KEY used to work, because the agent imported@ai-sdk/anthropic and @ai-sdk/openai and branched on an AI_PROVIDER
variable. That branching is gone: agent/agent.ts takes a single AI Gateway
model id, so one credential reaches every model and switching providers is a
string change.
If you specifically need to call a provider directly — an enterprise agreement,
a model the gateway does not carry, a self-hosted endpoint — it is a small change
rather than a supported flag:
npm install @ai-sdk/anthropic// agent/agent.ts
import { anthropic } from "@ai-sdk/anthropic"
import { defineAgent } from "eve"
export default defineAgent({
model: anthropic("claude-opus-4-8"),
})
Note the id format differs: a direct provider uses its own naming
(claude-opus-4-8), while the gateway uses anthropic/claude-opus-4.8.
Doing this gives up per-model routing, the shared spend view, and the OIDC option
below, and you take on a provider key to store and rotate. It is the right call
occasionally and the wrong default.
On Vercel you can skip the API key. Vercel mints a short-lived OIDC token scoped
to your project, the AI Gateway accepts it, and the AI SDK picks it up
automatically. Nothing to store, nothing to rotate, and nothing that keeps
working after someone leaves the team.
It is automatic for a deployed, linked project. Do not create an env var calledVERCEL_OIDC_TOKEN — Vercel injects it, and a stale hand-written one would
override the live token and start failing after two hours.
Deploy with no AI credential and try a real turn. If it works, you are done. If
it 401s, fall back to an API key — one command, and the two are interchangeable:
vercel env add AI_GATEWAY_API_KEY productionUnder the hood the token reaches a Vercel Function as an x-vercel-oidc-token
header rather than an environment variable. Vercel reuses one for up to 90
minutes against a two-hour TTL, so the spare 30 minutes covers a long-running
function. That is a detail the SDK handles; it matters only if you are reading
the token yourself.
vercel link # once
vercel env run -- npm run agent # fresh token, nothing written to disk
vercel env run -- npm run devvercel env run fetches your development environment variables and a fresh OIDC
token from the linked project, passes them to the command, and writes nothing to
the filesystem. That is the whole point: no credential on disk to leak, and no
expiry to think about, because you get a new token every time you start.
The alternative writes them to a file:
vercel env pull # writes .env.localTwo reasons to prefer env run:
env pull overwrites .env.local wholesale. Any local-only variable youUse env pull when a tool needs a real file and cannot be wrapped. Otherwiseenv run.
For a Vercel deployment: no. Not in production, and not locally either.
The one place you still need one is where nothing can mint a token for you:
| Where | Credential | Why |
|---|---|---|
| Production and preview on Vercel | OIDC, automatic | nothing to set, nothing stored |
| Local development | OIDC via vercel env run | fresh per run, nothing on disk |
| CI (GitHub Actions) | AI_GATEWAY_API_KEY secret | no linked Vercel project to issue a token |
| Self-hosted, or another cloud | AI_GATEWAY_API_KEY | Vercel is not the one running it |
The security difference is real, not cosmetic:
| API key | OIDC token | |
|---|---|---|
| Lifetime | until revoked | 2 hours in a Function, 12 hours pulled locally |
| Stored where | Vercel's env store, and a file on your laptop | nowhere in production — injected per invocation |
| If it leaks | spends money until someone notices and revokes it | expires on its own |
| Tied to | the person who created it | the project |
That last row matters more than it looks. Vercel deactivates API keys when their
creator leaves the team, so a key created by a departing colleague takes your
agent down with them. An OIDC token belongs to the project.
Confusingly, this repo uses Vercel OIDC for a second, unrelated purpose. Inagent/channels/eve.ts, vercelOidc() verifies inbound requests — it is how
schedules, subagents, and the eve CLI authenticate to the agent's own routes.
Two directions, same mechanism:
agent/channels/eve.ts): callers proving who they are to the agent.Setting AI_GATEWAY_API_KEY has no effect on the inbound side, and removingvercelOidc() from the auth walk has no effect on model access.
Start your app:
npm run devTest via CLI:
npm run agentType something like:
hello, are you working?If you get a response, you're connected.
mOperator defaults to these models:
| Provider | Default Model | Good For |
|---|---|---|
| Anthropic | claude-sonnet-4-5-20250929 | Tool use, structured data, long context |
| OpenAI | gpt-4o | General purpose, fast responses |
To override the model, set AI_MODEL in your .env.local:
AI_MODEL=claude-sonnet-4-5-20250929