Model credentials

How the Vendo Cloud model gateway fills every model seat, which model names it serves, how to pin one, and what a keyless turn does.

Your Cloud key is the model credential. Leave the models slot unset and every turn rides the console’s gateway.

How the gateway is wired

Managed inference is not a bespoke client. It is the stock @ai-sdk/anthropic provider, pointed at the console instead of at Anthropic.

One provider, one base URL swap. VENDO_API_KEY is the bearer token.

The console speaks the Anthropic Messages wire, which is the whole reason the stock provider serves it.

Gateway traffic does not carry Vendo’s deployment-identity headers, so inference never appears in the console’s deployment inventory. Usage still meters.

---

Which model you get

The gateway serves the vendo family as literal model ids. The console maps each name to a concrete model server-side, so a Cloud-keyed app can be retuned without a client release.

Name	Seat it serves
vendo	The default seat, and the default when no name is given
vendo-apps	The apps seat, which writes the generated apps
vendo-review	The review seat, which grades the finished ones
vendo-judge	The judge seat, the guard’s run/ask/block
vendo-extract	Tool extraction, in the CLI

Leave a seat unset and it takes its own family id above, so an empty models block still puts each job on the name tuned for it.

Names pass through verbatim — nothing is translated on the client. That is also how the default seat’s three billed tiers work: vendo-fast, vendo, and vendo-strong, at the rates on the Vendo Cloud page.

---

Pinning a model

Two ways, and an explicit model object beats both.

app/api/vendo/[...vendo]/route.ts

const vendo = createVendo({
  models: { default: "vendo-strong" },
  auth: authJs(),
});

.env.local

VENDO_MODEL=vendo-strong

Precedence runs top to bottom: an explicit model object, then the environment pin, then the configured string, then that seat’s own family name.

Every other seat has a pin of its own — VENDO_MODEL_APPS, VENDO_MODEL_REVIEW, VENDO_MODEL_JUDGE, and VENDO_MODEL_EXTRACT.

Passing your own AI SDK model object into models also works and always wins, so Vendo runs without a Cloud key.

---

If a seat has no model

Seats resolve lazily, on the first call that needs one. A missing credential therefore surfaces on the first turn, not at boot, as E-MODEL-001.

A provider key sitting in your shell is a credential, not a selection — Vendo never picks a provider for you. And if your product already runs its own agent loop, Vendo’s internal turns still need models of their own and will not borrow yours; leaving the seats unset is what hands them the gateway.

---

Verifying the model

vendo doctor names the credential the runtime will resolve. It reads your environment and makes no model call.

Terminal

$ npx vendo doctor

ok: model credential: VENDO_API_KEY (Vendo Cloud)

A key that is set but malformed reports E-CLOUD-001.