Hi Storypalse,

I’d first separate “the key cannot authenticate at all” from “the model request is being rejected.”

Try this with the same key your app is using:

1
curl -i https://ai-gateway.vercel.sh/v1/models \
2
  -H "Authorization: Bearer $AI_GATEWAY_API_KEY"
3

If this also returns 403 access_denied, then the request body/model is not the issue yet. I’d check:

• the key is an AI Gateway API key, not a provider key or Vercel dashboard token

• the key was created under the same Vercel team/account where AI Gateway is enabled/configured

• the env var in Production is actually the new key, then redeploy after changing it

• there is no per-key/team budget or credit issue causing requests to be denied

If /v1/models works, copy one exact model ID from that response and test a tiny generation with that model before trying xai/grok-4.3. That tells you whether the 403 is model/provider-specific or key-level.

The expected auth format is shown here:

https://vercel.com/docs/ai-gateway/authentication-and-byok/api-keys

vercel.com

AI Gateway API Keys

Create, view, and delete AI Gateway API keys, and set each key's budget and spend attribution, from the dashboard, CLI, or API.

Can you share the status code and redacted response body from the /v1/models test, plus the x-vercel-id header if it appears? Don’t post the API key.