Team-wide provider allowlist on AI Gateway
AI Gateway now supports a team-wide provider allowlist that restricts which AI providers can serve requests. Teams can enforce approved vendor lists at the gateway level, ensuring all traffic routes only through vetted providers regardless of request-level configuration or agent behavior.
AI Gateway now supports a team-wide provider allowlist. Teams can restrict which providers can serve requests, so traffic only routes to approved providers. The allowlist applies to every request through AI Gateway, including Bring Your Own Key (BYOK) traffic.
Regulated teams typically vet AI providers across multiple dimensions with security and legal sign-off, ending up with a vendor set that reflects the specific requirements of their org. The allowlist turns that approved-vendor list into a routing guarantee:
Toggle on in the AI Gateway tab. All current providers are allowed by default, so existing traffic is unaffected. Disable any providers your team shouldn't use.Provider AllowlistSettings
The allowlist filters by provider, not by model. AI Gateway falls back to other allowed providers for the same model if the initial provider fails. The allowlist also functions as an with other restrictions applied to the team, like Zero Data Retention (ZDR) or request-level filtering.and
For example, if a team has disabled DeepSeek in their allowlist and a request pins routing to only the DeepSeek provider:
Since DeepSeek is not in the allowlist, AI Gateway rejects the request.
Provider Allowlist works across every API format supported by AI Gateway, including AI SDK, OpenAI Chat Completions API, and Anthropic Messages API.
Read the for more information. For other account-level security and compliance functionality, check the and documentation. provider allowlist documentationZero Data RetentionDisallow Prompt Training
Enforcement happens at the gateway level, not at the request level. A developer on the team cannot route traffic to a provider the org hasn't approved.
This restriction also applies to coding agents. Even if an agent omits or modifies request-level provider filters, AI Gateway still blocks unapproved providers.
Only team owners can modify the provider allowlist, keeping control centralized and auditable.
New providers are disabled by default once the allowlist is on, so the approved set doesn't silently expand when AI Gateway integrates a new vendor.
How to configure
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.