What changed
On September 14, 2026, Vercel added native-subscription authentication to the AI SDK harness layer. `HarnessAgent` already normalizes coding-agent harnesses behind one interface; it can now use a harness’s existing subscription login when that harness supports it. In `direct` mode, explicit provider environment credentials win when present, otherwise the host can use a native subscription. The default `auto` mode follows the same path when AI Gateway credentials are absent. `ai-gateway` mode never reads native subscriptions. OAuth access tokens are resolved and refreshed at the host boundary, and where the sandbox supports the mechanism the harness receives placeholder credentials while the real token is inserted into outbound traffic by the host.
Why it matters
Agent platforms increasingly ask teams to choose between API-key billing and subscriptions they already pay for in products such as Claude Code, Codex, Cursor or GitHub Copilot. Vercel’s change makes subscription entitlement part of a programmable multi-harness layer instead of a manual login detail. The security boundary also matters: keeping long-lived or refreshable credentials outside the sandbox reduces the value of compromising the agent runtime. It does not make subscriptions universally portable—the underlying harness still has to support subscription login, and product terms and usage limits still apply.
Subscription access becomes part of the harness abstraction
AI SDK 7 already made it possible to wrap different coding-agent harnesses behind `HarnessAgent`. Native subscription authentication means the application can also reuse the authentication path each harness already supports rather than requiring every agent to be reconfigured around a provider API key.
Authentication mode decides which billing path wins
`direct` and `auto` can fall back to a native subscription found on the host, while explicit credentials still take precedence. `ai-gateway` deliberately stays separate and does not inspect those subscriptions, preserving a clear choice between Gateway billing and harness-native access.
The sandbox does not need the real OAuth token
Vercel resolves and refreshes credentials at the host boundary. When the sandbox supports placeholder credentials, the runtime can make an authenticated request without receiving the actual access token; the host swaps the credential into the outbound request.
One interface can now span both harness choice and entitlement choice
The practical result is a wider portability layer. An application can switch among several coding harnesses without rewriting its core agent integration, while each supported harness can use the user or host’s existing subscription where appropriate.
Native subscriptions are not equivalent to unrestricted API accounts
A subscription can carry product-specific quotas, acceptable-use terms and feature boundaries that differ from an API account. Builders need to test concurrency, automation permissions and rate limits rather than assume a paid interactive subscription behaves like an unmetered machine credential.