Implement OIDC support for Gateway (#183)

* Implement OIDC support for Gateway

Make vercel dep optional

Add local middleware patch to fastapi vite

Remove middleware hacks from the OIDC example

* Clean up the rebase

Author: anbuzin

README.md

@@ -8,13 +8,14 @@ A toolkit for building LLM-powered applications and agent loops.
 uv add ai
 ```
 
-AI Gateway usage works with the base package. Direct providers that use an
-OpenAI-compatible or Anthropic-compatible adapter load the corresponding
-official SDK lazily and require optional extras:
+AI Gateway API-key usage works with the base package. Direct providers that
+use an OpenAI-compatible or Anthropic-compatible adapter load the corresponding
+official SDK lazily. Vercel OIDC for AI Gateway also uses an optional extra:
 
 ```bash
 uv add "ai[openai]"      # OpenAI-compatible providers
 uv add "ai[anthropic]"   # Anthropic-compatible providers
+uv add "ai[vercel]"      # Vercel OIDC for AI Gateway
 ```
 
 ```python

examples/fastapi-vite/.gitignore

@@ -17,3 +17,4 @@ data/
 
 # Vercel
 .vercel
+.env*

examples/fastapi-vite/backend/pyproject.toml

@@ -5,7 +5,7 @@ description = "Chat demo using Python Vercel AI SDK with FastAPI"
 requires-python = ">=3.12"
 dependencies = [
     "fastapi[standard]>=0.128.1",
-    "ai>=0.0.1.dev5",
+    "ai[vercel]>=0.2.1",
 ]
 
 [tool.uv]

examples/fastapi-vite/e2e-test/run.sh

@@ -38,7 +38,7 @@ trap cleanup EXIT
 echo "Starting backend on :$BACKEND_PORT..."
 (
     cd "$ROOT/backend"
-    uv run --frozen --with-editable ~/src/py-ai/ fastapi dev main.py --port "$BACKEND_PORT"
+    uv run --frozen --with-editable "$ROOT/../.." fastapi dev main.py --port "$BACKEND_PORT"
 ) > "$LOGS/backend.log" 2>&1 &
 BACKEND_PID=$!
 

examples/fastapi-vite/frontend/pnpm-lock.yaml

@@ -38,6 +38,9 @@ dependencies = [
 anthropic = ["anthropic>=0.83.0"]
 mcp = ["mcp>=1.18.0"]
 openai = ["openai>=2.14.0"]
+vercel = [
+    "vercel>=0.5.9",
+]
 
 [build-system]
 requires = ["hatchling", "uv-dynamic-versioning>=0.7.0"]

pyproject.toml

@@ -1,6 +1,6 @@
 """Async client for the AI Gateway provider protocol."""
 
 from . import errors
-from ._client import GatewayClient, ModelType
+from ._client import AuthMethod, GatewayClient, ModelType
 
-__all__ = ["GatewayClient", "ModelType", "errors"]
+__all__ = ["AuthMethod", "GatewayClient", "ModelType", "errors"]

src/ai/providers/ai_gateway/client/__init__.py

@@ -19,6 +19,7 @@
 _PROTOCOL_VERSION = "0.0.1"
 
 ModelType = Literal["language", "image", "video"]
+AuthMethod = Literal["api-key", "oidc"]
 
 
 class GatewayClient:
@@ -33,12 +34,14 @@ def __init__(
         self,
         *,
         base_url: str,
-        api_key: str | None = None,
+        auth_token: str | None = None,
+        auth_method: AuthMethod | None = None,
         headers: Mapping[str, str] | None = None,
         client: httpx.AsyncClient | None = None,
     ) -> None:
         self.base_url = base_url
-        self.api_key = api_key
+        self.auth_token = auth_token
+        self.auth_method = auth_method
         self.headers = dict(headers or {})
         self._http = client or httpx.AsyncClient(
             timeout=httpx.Timeout(timeout=300.0, connect=10.0),
@@ -59,9 +62,9 @@ def origin_url(self, path: str) -> str:
     def protocol_headers(self) -> dict[str, str]:
         headers = dict(self.headers)
         headers["ai-gateway-protocol-version"] = _PROTOCOL_VERSION
-        if self.api_key:
-            headers["Authorization"] = f"Bearer {self.api_key}"
-            headers["ai-gateway-auth-method"] = "api-key"
+        if self.auth_token and self.auth_method:
+            headers["Authorization"] = f"Bearer {self.auth_token}"
+            headers["ai-gateway-auth-method"] = self.auth_method
         return headers
 
     def model_headers(
@@ -165,7 +168,7 @@ async def probe_model(self, model_id: str) -> None:
         auth_resp = await self.get("v1/credits", origin=True)
         if auth_resp.status_code in {401, 403}:
             raise errors.GatewayAuthenticationError.create_contextual(
-                api_key_provided=bool(self.api_key),
+                auth_method=self.auth_method if self.auth_token else None,
                 status_code=auth_resp.status_code,
             )
         if auth_resp.status_code != 200:
@@ -239,7 +242,7 @@ async def raise_for_error(self, response: httpx.Response) -> None:
         raise errors.create_gateway_error(
             response_body=response.text,
             status_code=response.status_code,
-            api_key_provided=bool(self.api_key),
+            auth_method=self.auth_method if self.auth_token else None,
         )
 
     async def iter_sse(