AI Gateway
AI Gateway Provider Allowlist
The provider allowlist is a team-wide setting that applies to every request. If you only need to restrict providers on individual requests, use the only parameter in providerOptions instead at no additional cost.
Provider Allowlist
The provider allowlist lets team owners restrict which AI providers can serve requests through AI Gateway. A request only returns a 403 when no allowed provider can serve it. The feature is opt-in and available on Pro and Enterprise plans.
Copy page
A common reason to enable this is compliance: your team has reviewed a specific set of providers, and you want to guarantee that AI Gateway never routes to one you haven't approved.
Option
Per-request only filter
Cost
No additional cost
Availability
All plans
Team-wide provider allowlist
Only team owners can change this setting.
$0.10 per 1,000 successful requests
- Open the AI Gateway Settings tab.
- Toggle on Restrict allowed providers.
Pro and Enterprise
The team-wide surcharge applies only to successful responses. Requests blocked by the allowlist (403) and other failures are not charged.
When you toggle on, every provider currently available on AI Gateway is added to the allowlist by default. This guarantees that turning the feature on never breaks existing traffic. You then remove providers you want to block as an explicit action.
Disabling specific providers
With the allowlist enabled, switch off any providers your team should not use. The list is searchable. The footer shows how many providers are currently enabled.
Disabling a provider removes it from the routing candidates for any request. If the model has other providers that are still allowed, AI Gateway falls back to one of them. If every candidate provider for the request is disabled, the request returns:
{
"error":"Your team has restricted access to this provider. Contact the owner of the account for more details."
"type":"no_providers_available",
"statusCode":403
}
The allowlist filters by provider only. A model like openai/gpt-5.4-mini is served by both openai and azure; disabling openai alone still routes that model through azure. To block a model entirely, disable every provider that serves it.
New providers
When AI Gateway adds a new provider after you enable the allowlist, the new provider is disabled by default and shows a New badge in the settings list. An info note at the top of the list tells you how many new providers are waiting for a decision.
To clear the badges, decide which new providers to enable and click Save. A save with no changes also counts as acknowledgment and clears the badges. Disabled new providers stay disabled until you enable them.
Request-level filtering
If you also use the request-level only filter in providerOptions, both filters apply. A request must satisfy both:
Pro or Enterprise (not Pro trial)
If either filter rejects every candidate, the request returns a 403.
Requirement
The allowlist applies to BYOK requests too. Disabling a provider means your team does not want any traffic to that provider through AI Gateway, even with your own credentials.
Detail
Owner
Plan and role requirements
- The provider must be in the request's only list, and
- The provider must be in your team's allowlist.
Last updated September 8, 2026
Team members on non-owner roles can view the current configuration but cannot modify it.
Cross-link map: AI Gateway Provider Allowlist (/docs/ai-gateway/security-and-compliance/provider-allowlist)From the Vercel docs graph (built 2026-09-21T05:26:59.511Z), spanning vercel.com docs + KB, nextjs.org, ai-sdk.dev, and other Vercel documentation sites. Full graph as JSON: https://vercel.com/docs/graph.jsonSemantically closest pagesAI Gateway Model Allowlist — Restrict which AI models your team can use through AI Gateway. Available on Pro and Enterprise.Team-wide provider allowlist on AI GatewayAI Gateway Security and Compliance — AI Gateway data privacy and governance controls: zero data retention, prompt training policies, and provider allowlists.AI Gateway Routing Rules — Define team-wide rules that rewrite requests from one model to another or deny specific models in AI Gateway.OpenResponses Configuration with AI Gateway — Configure provider routing, fallbacks, and restrictions using the OpenResponses API through AI Gateway.This page links to (2)Bring Your Own Key \(BYOK\) to AI Gateway — Learn how to configure your own provider keys with AI Gateway.AI Gateway Provider Routing and Fallbacks — Configure provider routing, ordering, and fallback behavior in Vercel AI Gateway.Pages that link here (7)By site: vercel-changelog (2) · vercel-docs (5)From vercel-changelog Routing rules now available on AI GatewaySet up coding agents in one command with AI GatewayFrom vercel-docsAI Gateway FAQ — Answers to common questions about AI Gateway, including request errors, pricing and markup, SDK and API compatibility, mAI Gateway Routing Rules — Define team-wide rules that rewrite requests from one model to another or deny specific models in AI Gateway.AI Gateway Pricing — Understand AI Gateway token pricing, free and paid credits, BYOK costs, add-on charges, and payment fees. Manage creditAI Gateway Security and Compliance — AI Gateway data privacy and governance controls: zero data retention, prompt training policies, and provider allowlists.AI Gateway Model Allowlist — Restrict which AI models your team can use through AI Gateway. Available on Pro and Enterprise.
Was this helpful?
