AI SDK harness auth: keep native subscriptions on the host boundary

On September 14, 2026, Vercel shipped native subscription authentication for the AI SDK harness layer. If you run coding agents through HarnessAgent, that change decides where credentials live and which bill pays for the run. The builders who miss it keep stuffing API keys into sandboxes. The builders who read it keep subscriptions on the host and pick an auth mode on purpose.

This post is for production teams already wiring Claude Code, Codex, Cursor, Copilot, or sibling harness adapters behind one application API. Pair it with OpenAI Agents on Vercel: own the Queue and Sandbox hosting seam for hosting shape, and with OpenAI project API keys can expire: set max lifetime and rotate secrets for key hygiene that still applies when you use explicit credentials.

Changelog capture: https://vercel.com/changelog/ai-sdk-harness-native-subscription-authentication (2026-09-15)

What shipped

Vercel's changelog is explicit:

• The harness layer can authenticate harnesses through their native subscriptions when the underlying harness supports them.
• You still program against one HarnessAgent interface, so swapping harnesses does not require rewriting the application loop.
• No new settings or code changes are required for the default behavior to pick up the feature.
• Auth modes matter:
  • direct uses explicit provider environment credentials when present, otherwise a native subscription on the host
  • auto (default) does the same when no AI Gateway credentials are set
  • ai-gateway never reads native subscriptions
• Native subscription credentials stay on the host. OAuth access tokens refresh at the host boundary. Where the sandbox supports it, the harness sees placeholder credentials and the host injects the real token into outbound requests.

Supported adapters called out for subscription login include Claude Code, Cline, Codex, Cursor, fx, GitHub Copilot, Grok Build, OpenCode, and Pi.

That is the whole ship note. Everything below is how to operationalize it without inventing undocumented flags.

Why this changes production behavior

Before native subscription auth, a hosted harness path usually meant one of two moves:

1. Put provider API keys in the environment the agent process can read
2. Route model access through a gateway and keep application secrets there

Subscriptions complicate both. Claude Code, Cursor, Copilot, and peers often authenticate as a logged-in product subscription on a machine — not as a static key you want copied into every sandbox. The September 14 change formalizes the host-boundary pattern: resolve credentials where the host already has the login, refresh OAuth there, and avoid teaching the sandbox the real token when injection is available.

For ICP builders shipping agent features on Vercel, the practical consequences are:

• You can run HarnessAgent demos and internal tools against the same subscriptions your engineers already pay for, without minting a second set of keys for every sandbox.
• You must decide whether production should use those subscriptions (direct / auto) or force AI Gateway (ai-gateway) so spend and audit trails stay on one team credential.
• Sandbox isolation stays meaningful only if you treat host injection as a security boundary, not as a shortcut to paste secrets into the guest.

How HarnessAgent fits the stack

The earlier AI SDK 7 harness announcement (June 12, 2026) introduced HarnessAgent as a single API over established agent runtimes. Harnesses own skills, sandboxes, sessions, permission flows, compaction, and sub-agents above a model call. Adapters live in packages such as @ai-sdk/harness-claude-code and @ai-sdk/harness-codex, used with @ai-sdk/harness/agent and a sandbox factory like createVercelSandbox.

A minimal shape from that announcement:

import { HarnessAgent } from '@ai-sdk/harness/agent';
import { claudeCode } from '@ai-sdk/harness-claude-code';
import { createVercelSandbox } from '@ai-sdk/sandbox-vercel';

const agent = new HarnessAgent({
  harness: claudeCode,
  sandbox: createVercelSandbox({
    runtime: 'node24',
    ports: [4000],
  }),
  tools: { /* custom tools */ },
  skills: [ /* custom skills */ ],
});

const session = await agent.createSession();
try {
  const result = await agent.stream({
    session,
    prompt: 'Check the test failures and fix the production code.',
  });
  for await (const part of result.fullStream) {
    if (part.type === 'text-delta') {
      process.stdout.write(part.text);
    }
  }
} finally {
  await session.destroy();
}

Swap the harness import to change runtimes without rewriting the stream consumer. The September 14 auth change sits under that same interface: authentication mode chooses how the host supplies credentials to whichever adapter you selected.

Harness packages are still marked experimental in the June announcement — expect breaking changes between releases. Treat auth mode as part of your upgrade checklist, not as a one-time set-and-forget toggle.

Pick an auth mode before you ship traffic

Use this decision table with the changelog wording as the source of truth:

1. Local engineer laptop / internal dogfood
   Prefer direct or default auto so a logged-in Claude Code / Cursor / Copilot subscription on the host can back the run when no explicit key is present.

2. Shared production service with centralized spend
   Prefer ai-gateway so native subscriptions are never read. Bill and audit through AI Gateway credentials your team owns.

3. CI or headless hosts without product logins
   Provide explicit provider environment credentials for direct, or configure AI Gateway. Do not assume a native subscription exists on a bare runner.

4. Mixed fleet
   Document the mode per environment in the repo (AGENTS.md / deploy docs). Agents that invent "just export ANTHROPIC_API_KEY into the sandbox" will fight the host-boundary design.

Host boundary checklist

Run these checks the first time you enable harness traffic after the change:

# 1) Confirm which auth mode each environment intends
# production: ai-gateway  |  laptop dogfood: auto/direct

# 2) Confirm the host has the intended login OR gateway credential
# (product subscription session vs AI Gateway key / OIDC)

# 3) Confirm the sandbox does not receive long-lived provider secrets
# when host injection is available

# 4) Confirm OAuth refresh happens on the host, not inside guest code

Then answer out loud with the team:

• Who pays for a failed loop — a personal Cursor subscription or the company AI Gateway budget?
• What appears in logs if a token refresh fails at the host boundary?
• Which harness adapters are allowed in production (Claude Code, Codex, Cursor, Copilot, …)?

If those answers are fuzzy, freeze production on ai-gateway until they are not.

Owned-repo outcome

Treat harness auth like any other production seam you want coding agents to respect:

• Encode the auth mode per environment in repo docs the agent reads first
• Keep sandbox creation and host credential injection as separate responsibilities
• Link session destroy / cleanup to the same path as your other agent runbooks
• Prefer gateway credentials for customer-facing traffic so a departing teammate's product login cannot silently become your production auth

OTF's angle here is not a new harness package. It is the same owned-repo habit as the rest of the agent cluster: put the policy where humans and agents can both find it, then verify against live vendor docs. Start from the templates page when you need a kit that already ships AI configs beside application code — then layer harness auth decisions on top for the agent runtime you actually host.

Practical checklist

• Changelog date confirmed: 2026-09-14 native subscription authentication for AI SDK harness layer
• Auth mode chosen per environment: direct / auto / ai-gateway
• Production spend path named: native subscriptions vs AI Gateway
• Host keeps credentials; sandbox gets placeholders when injection is supported
• Allowed harness adapters listed for production
• Related hosting post reviewed: /blog/vercel-openai-agents-sandbox
• Key rotation habits still apply when using explicit credentials: /blog/openai-api-key-expiration

Bottom line

Native subscription auth for AI SDK harnesses makes host-boundary credentials the default story for Claude Code, Cursor, Copilot, and peer adapters. Choose ai-gateway when you need centralized production spend. Choose direct or auto when a host subscription is intentional. Do not confuse "no code changes required" with "no policy decision required."

Sources

• AI SDK harness layer now supports native subscription authentication — Sept 14, 2026 changelog (modes, host boundary, adapter list)
• Program agent harnesses with AI SDK — June 12, 2026 HarnessAgent introduction and example
• AI SDK Harnesses — adapter catalog and HarnessAgent usage
• OTF templates — live kit inventory for owned-repo AI configs