Vercel AI Gateway alternative: host-portable LLM gateway

The Direct Answer: Looking for a Vercel AI Gateway alternative? While Vercel offers zero per-token markup, their own documentation confirms that BYOK spend cannot be capped by budgets and governance features are gated to Pro/Enterprise tiers. nRouter provides a host-neutral LLM gateway that enforces Key > Team > Org budget ceilings across 100% of spend, includes inline guardrails on every plan, sells one pay-as-you-go plan at a 0% platform fee, and settles usage at exact provider list prices with zero per-token markup.

If you are here because of the coupling: Vercel AI Gateway charges no markup on tokens, which makes it very hard to beat on price and very easy to adopt from a Next.js route. The question worth asking before you standardise on it is not "what does it cost" — it is "what can I enforce through it, from code that does not run on Vercel." That question has three specific answers in Vercel's own docs, and they are what this post is about.

Why teams search for a Vercel AI Gateway alternative

Figure 1: Vercel BYOK budget gap vs nRouter 100% comprehensive spend ceilings.

1. A budget cannot cap BYOK spend. This is the sharpest one, and it is not an inference from architecture — it is in Vercel's BYOK documentation: spend through your own credentials "isn't counted in budgets… It's metered separately and doesn't count toward a team, project, or API key limit, so a budget can't be used to cap BYOK spend" (BYOK docs, checked 2026-08-23). BYOK is also the recommended path for using provider-granted credits and for reaching private cloud data, so the traffic most likely to be BYOK is often the traffic with the largest or least predictable bill. A budget that covers some of your spend is a report, not a control.

2. BYOK is paid-tier, requires purchased credits, and falls back silently. The same page: BYOK is available on the paid tier, and to use it your team needs purchased AI Gateway credits, because when a request with your credentials fails, the gateway keeps it running by falling back to system credentials — and that fallback usage is billed against your credit balance. It is a sensible availability choice. It also means the answer to "whose key paid for this call?" is sometimes yours and sometimes theirs, decided at runtime by a failure you did not see. Zero Data Retention interacts with the same seam: with ZDR enabled, the gateway skips your BYOK keys by default unless you have marked an individual key as ZDR-compliant under your own provider agreement.

3. Some governance is plan-gated, and auth assumes a Vercel deployment. Model Allowlist — restricting which models your team can reach — is documented as available on Pro and Enterprise (model allowlist, checked 2026-08-23). And the gateway's two authentication methods are an API key or a Vercel OIDC token (authentication, checked 2026-08-23). OIDC is the better of the two — a short-lived, deployment-scoped identity beats a long-lived secret in an env var — and it is issued to a Vercel deployment. Code running on Lambda, Cloud Run, a Fly machine or a customer's own infrastructure is back to the static key, which means the good authentication story is the one that only works where you already deploy.

None of this makes Vercel AI Gateway a bad product. It makes it a gateway whose strongest guarantees are strongest inside Vercel.

Side-by-side, on the axes that decide it

Rows chosen for where the products actually differ. Every Vercel and Cloudflare cell traces to that vendor's own documentation, checked on the date in ## Sources.

Vercel and Vercel AI Gateway are trademarks of Vercel Inc.; Cloudflare and Cloudflare AI Gateway are trademarks of Cloudflare, Inc. nRouter is not affiliated with or endorsed by either. All claims above are sourced from their public pricing or documentation on the dates linked in ## Sources; if any have changed, email hello@nrouter.ai and we will update.

The budget hole, worked

Take a team with three workloads: a customer-facing chat feature on Vercel system credentials, a batch enrichment job running on their own OpenAI enterprise agreement because that is where their committed spend lives, and an internal analytics agent on a Bedrock account with a SigV4 credential.

On Vercel, workloads two and three are BYOK. A team budget will happily cap workload one and will not see the other two at all — Vercel documents that BYOK spend does not count toward a team, project, or API key limit. The month the enrichment job regresses into a retry loop, the budget you configured is untouched and the bill that moves is your OpenAI invoice, on a different cadence, reconciled by a different person. The control existed. It was pointed at a third of the spend.

nRouter's answer is structural rather than clever: there is no BYOK, so there is no second meter. Every call is authenticated with an sk-nrouter-… key, every dollar lands in one ledger, and a ceiling is therefore able to be enforced before the provider call rather than reported after it. When an organisation, team or user ceiling is exhausted the request is refused with 402 budget_exceeded; when a per-key ceiling is exhausted it is refused with 429 key_budget_exceeded. Two different codes because they are two different problems — the first is a finance decision, the second is one key behaving badly and the other keys on the team still working. Both are used as HTTP defines them rather than as house codes: 402 Payment Required is reserved for the payment case, and 429 Too Many Requests describes a condition that clears with time, which is precisely the difference between the two ceilings.

That trade has a real cost and you should price it honestly: with no BYOK you cannot spend provider-granted credits through nRouter, you cannot point us at your own private deployment, and you cannot use a negotiated enterprise rate you already hold. If any of those is load-bearing, Vercel's BYOK is a feature you need and we do not have. The full argument for the trade — including what we gave up to make it — is in why nRouter does not do BYOK.

One consumer-side detail worth carrying across: nRouter reports an unknown cost as unpriced and omits the x-nr-request-cost header entirely rather than sending a zero, paired with x-nr-cost-status. A dashboard that treats a missing cost as 0 will under-report rather than show a gap, which is exactly the failure mode a budget is supposed to prevent.

What Vercel AI Gateway does better

Zero markup with BYOK credentials. Tokens at the rates the providers themselves publish — Anthropic posts its per-million-token prices openly, so "provider rate" is a number either side can be held to rather than a claim. Tokens at provider rates, with BYOK included. If your finance team requires spending down direct provider commits via BYOK credentials, that is a straightforward reason to stay, and it does not stop being an advantage because we would rather talk about budgets.

The AI SDK. generateText, streaming, tool calling and structured outputs across providers, with the gateway as a first-class provider, is the most pleasant TypeScript surface in this category. nRouter is an OpenAI-compatible endpoint; you can point @ai-sdk/openai-compatible at it, but the ergonomics of the native integration are Vercel's and we are not going to pretend otherwise.

Data controls that are actually documented. Zero Data Retention enforceable per request or team-wide, a documented way to disallow prompt training, and regional inference with an inferenceRegion that also applies to BYOK requests. nRouter's compliance position is that SOC 2 Type II is in progress — in progress, not certified — and a team with a data-residency requirement today should weigh a shipped, documented control over a roadmap.

Provider breadth. Vercel's catalog is wider than ours, including families nRouter does not serve at all. No Google model is in nRouter's live catalog. If Gemini is on your shortlist this comparison is over.

OIDC. A deployment-scoped, short-lived identity is better than a static secret. It is limited to Vercel deployments, which is the point of this post, but where it applies it is the stronger design.

Pricing: the one number that matters here

nRouter sells one plan, pay as you go, at a 0% platform fee. A credit purchase charges exactly the credits bought ($5 costs $5.00, $100 costs $100.00), nRouter absorbs card-processing costs, and usage settles at the served model's exact list price with 0% markup. Every governance control — guardrails, evals, A/B tests, prompt management and enforceable budgets — is included on every account without subscription gates or enterprise tiers. No subscription plan is sold (existing subscribers keep theirs). The plan table lives on /pricing.

Paid pay-as-you-go usage requires purchased credits: a card is required, and the minimum credit purchase is $5, which charges exactly $5.00 for $5.00 in credits.

Switch cost: one base URL, one API key

If you already call the gateway through an OpenAI-compatible client, the change is two lines:

  // your existing code, OpenAI SDK or any OpenAI-compatible client
  const client = new OpenAI({
-   baseURL: 'https://ai-gateway.vercel.sh/v1',
-   apiKey: process.env.AI_GATEWAY_API_KEY,
+   baseURL: 'https://api.nrouter.ai/v1',
+   apiKey: process.env.NROUTER_API_KEY,
  });

If you are on the AI SDK, @ai-sdk/openai-compatible points at any OpenAI-compatible base URL, so the change is the same two values inside createOpenAICompatible. Model strings change shape — Vercel's slugs are provider-prefixed, and you should map them against nRouter's live catalog rather than assuming a name carries across.

What leaves your configuration entirely is the credential fan-out: the per-provider BYOK entries, the request-scoped byok blocks, and the modelMappings arrays that point a gateway slug at your own Azure deployment names. nRouter holds the provider credentials, so there is nothing on your side to rotate, scope to a team, or test from a dashboard.

Migrating your Vercel-specific config

Maps cleanly. Provider fallback ordering becomes routing configuration. Budgets become organisation, team and per-key ceilings — and, unlike the originals, they cover every dollar. Spend monitoring becomes per-key and per-team spend. App attribution becomes per-key identity, which is the same idea with a credential attached to it.

Maps differently. Vercel's OIDC token has no counterpart: nRouter authenticates a virtual key, not a deployment. The equivalent hygiene is a short-lived, narrowly scoped key per service rather than one shared secret, plus rotation when a service is retired. That is more work than OIDC and less work than a per-provider key matrix.

Has no equivalent. Request-scoped byok, modelMappings, inferenceRegion and per-request ZDR all assume you supply the provider credential; with no BYOK there is nothing for them to attach to. Google-family models have no equivalent because they are not in the catalog. And the AI SDK's native gateway provider becomes the OpenAI-compatible provider — same calls, less sugar.

Why every feature on every plan is sustainable

Short version: the platform fee is 0%; a purchase charges exactly the credits bought; nRouter earns on capacity and enterprise, not on a fee, which is why there is no commercial reason to gate a budget or a guardrail behind an upgrade the way Model Allowlist sits on Pro and Enterprise. The long version — what funds it, and what would have to change for the position to break — is written once, here: Every Feature on Every Plan: No Fee, No Gate.

When nRouter is the right choice

Pick nRouter over Vercel AI Gateway if two or more of these are true:

• You need a spending cap that covers all of your LLM spend, not the share of it that runs on system credentials.
• Meaningful inference originates outside Vercel — Lambda, Cloud Run, Fly, a Kubernetes pod, a customer's own environment — and you want the same rules to apply there without a second auth story.
• You want model restriction, guardrails, evals and per-team budgets on pay as you go rather than on Pro and Enterprise.
• You would rather never hold a provider key again, including the ones you are currently holding only because a budget could not reach them.
• Your shortlist is Anthropic, OpenAI, Azure AI Foundry and Bedrock models.

When to stay on Vercel AI Gateway

Stay if any of these is true. These are not close calls:

• A Google, Gemini or Vertex model is on your shortlist. nRouter serves none.
• You hold provider-granted credits or a negotiated enterprise rate you need to spend through the gateway. That is BYOK, and BYOK is theirs.
• You have a data-residency or ZDR requirement today. Vercel ships documented controls; nRouter's SOC 2 Type II is in progress.
• Every AI call originates from a Vercel deployment and OIDC is doing real work in your threat model.
• The AI SDK's native gateway integration is deep in your codebase and the ergonomic downgrade costs you more than the governance gap costs you.

For everyone else — teams whose spend crossed a hosting boundary, teams who discovered their budget covered a third of the bill — the switch is the two lines above.

Try it

When comparing host-portable gateways, eligible new accounts can receive $100 in promotional credits after email and phone verification, without a card. Promotional access has a restricted model set and spending limits; see current pricing and promotion terms.

Pay as you go starts at $5. Load the $5 minimum (a purchase charges exactly the credits bought, $5 for $5.00). Set a team budget deliberately low and watch a call come back 402 budget_exceeded — the cheapest possible way to find out whether a governance claim is real.

→ Get started at app.nrouter.ai/signup

Questions go to the public nRouter Slack — #support for migration, #feature-requests if there is a Vercel capability you want next.

See also

• nRouter vs Vercel AI Gateway — the side-by-side feature and architectural comparison.
• Cloudflare AI Gateway alternative — the other platform-bundled gateway, where the coupling is the edge and a 5% credit fee rather than BYOK.
• Helicone alternative — the observability-first comparison, where the wall is a $79/mo plan line.
• OpenRouter alternative — the head-term comparison in this cluster.
• No BYOK: One nRouter Key Instead of Ten Provider Keys — the position the budget section above rests on.
• Every Feature on Every Plan: No Fee, No Gate — how a 0% platform fee with no feature gates is meant to pay for itself.
• Managed LLM Gateway vs Self-Hosted: Why We Carry the Pager — the other half of the deployment argument.
• Pricing — the canonical plan table.

Sources

Every Vercel and Cloudflare claim above is sourced from that vendor's own public documentation and was checked on 2026-08-23. If a vendor has changed a number since, email hello@nrouter.ai and we will re-audit within one business day.

• Vercel AI Gateway overview (no markup on tokens, feature list), checked 2026-08-23: vercel.com/docs/ai-gateway
• Vercel AI Gateway BYOK (paid tier, purchased credits required, fallback to system credentials, budgets cannot cap BYOK spend, ZDR interaction, modelMappings), checked 2026-08-23: vercel.com/docs/ai-gateway/authentication-and-byok/byok
• Vercel AI Gateway authentication (API key or OIDC token), checked 2026-08-23: vercel.com/docs/ai-gateway/authentication-and-byok
• Vercel AI Gateway OpenAI Chat Completions (base URL, AI_GATEWAY_API_KEY), checked 2026-08-23: vercel.com/docs/ai-gateway/sdks-and-apis/openai-chat-completions
• Vercel AI Gateway Model Allowlist (Pro and Enterprise), checked 2026-08-23: vercel.com/docs/ai-gateway/security-and-compliance/model-allowlist
• Vercel AI Gateway budgets, checked 2026-08-23: vercel.com/docs/ai-gateway/observability-and-spend/budgets
• Vercel pricing, checked 2026-08-23: vercel.com/pricing
• Cloudflare AI Gateway Unified Billing (5% credit fee, provider coverage), checked 2026-08-23: developers.cloudflare.com/ai-gateway/features/unified-billing
• Anthropic pricing, checked 2026-08-23: anthropic.com/pricing — the published per-token rate that "zero markup" is measured against on both sides.
• RFC 9110 §15.5.3, 402 Payment Required: datatracker.ietf.org/doc/html/rfc9110 — the HTTP semantics of the org, team and user refusal.
• RFC 6585 §4, 429 Too Many Requests: datatracker.ietf.org/doc/html/rfc6585 — the HTTP semantics of the per-key refusal.
• nRouter pricing: /pricing · nRouter live catalog: /models

Vercel, Cloudflare and Anthropic are trademarks of their respective owners. nRouter is not affiliated with or endorsed by them.