Authentication

To use AI models in fx, sign in with Vercel or add a Vercel AI Gateway API key.

Sign in

Sign in with Vercel:

fx login opens the Vercel authorization flow. The OAuth session is saved in ~/.fx/auth.json and refreshed when needed.

In a headless environment, set FX_NO_OPEN_BROWSER=1 before fx login to print the authorization URL instead of trying to open it.

Use an AI Gateway API key

fx setup prompts you to paste an API key without displaying it, then saves the key in the platform credential store:

On macOS, fx stores the key in Keychain. On Linux, it stores the key in ~/.fx/api-key and makes the file readable only by your user.

For CI, store the key in your CI provider's secret manager and expose it as AI_GATEWAY_API_KEY only to the job that runs fx. Do not write the key directly in the workflow.

Credential selection

Unless you choose a source with /setup, fx uses the first available credential in this order:

1. VERCEL_OIDC_TOKEN, when provided automatically by a Vercel runtime
2. AI_GATEWAY_API_KEY, set for the current process
3. a saved fx login session
4. an API key saved with fx setup

Choosing a source in /setup makes it the default across restarts. If that source is unavailable, fx falls back to the order above.

Change Vercel team

An fx login session can switch between the Vercel teams available to your account:

The picker saves the selected team in the login session. That team scopes AI Gateway requests, the model catalog, and Gateway credit checks, so model availability can differ between teams. Run /status to inspect the active gateway_team.

fx teams requires an fx login session.

Inspect or remove credentials

Run fx status to inspect the active model, credential source and team, permission mode, sandbox, workspace, and update channel:

Remove the saved Vercel login:

fx logout removes the saved OAuth session. It does not remove a stored API key.