Every request to the Vercel AI Gateway returns a 403 Forbiddenaccess_denied response, including the auth-only /v1/credits endpoint. The block appears to be at the team/account level — no model, key, or request shape changes the result.
What I’ve Tried
Created a fresh API key (rotated vck_… twice)
Removed and re-added my payment method
Purchased $15 of paid credits via vercel buy credits gateway 5 (succeeded, balance shows on dashboard)
Tested with curl directly to https://ai-gateway.vercel.sh/v1/credits with Authorization: Bearer <key> — same 403
Confirmed an obviously-invalid key returns 401, so the 403 is specifically an authorization decision against my team
Tried adding a BYOK Anthropic key — the BYOK “Test Request” also fails with HTTP 200 Connection Failed — Forbidden, which matches the known issue vercel/ai#11280 (credit check happens before BYOK routing)
Error
{
"error": {
"message": "Forbidden.",
"type": "access_denied"
}
}
Team ID
team_GcNnvGv1HR62xqaolnXc8vQg
Could someone please patch this on the team, like was done for the other threads (Mar 22, Feb 15, Jan 21)? Happy to provide the project ID, a request ID, or a deployment URL if useful.
Hi @pranayhaldiya, I see. After checking with the AI Gateway team, we were able to rectify this issue for you and you should be able to use the AI Gateway keys now.
I’m experiencing an issue with my Vercel project where my firewall is blocking requests from a critical server, and I’m unable to manage the firewall settings.
Project: monime-dash-ussd-flow-exchange
The Problem:
Requests from my server (Monime-USSD-Gateway) are being blocked with 403 errors
I previously set up a User Agent bypass rule for “Monime-USSD-Gateway” which was working, but the requests are now being blocked again
I use a User Agent bypass because the server doesn’t have a static IP
Additional Issue:
When I try to access my project’s Firewall settings page, I see a blank screen
I’m on the Hobby plan, but it appears that WAF Managed Rulesets (Generic Attack Detection, RCE, XSS, SQLi) are somehow enabled on my project
I cannot disable these rules because the firewall page won’t load
What I Need:
Help understanding why my firewall page shows blank
Assistance disabling the WAF managed rulesets that may be blocking my legitimate traffic
This is affecting a critical business integration. Any help would be greatly appreciated!
Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.
Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.
Every request to the Vercel AI Gateway returns a 403 Forbiddenaccess_denied response, including the auth-only /v1/credits endpoint. The block appears to be at the team/account level — no model, key, or request shape changes the result.
What I’ve Tried
Created a fresh API key (rotated vck_… twice)
Removed and re-added my payment method
Purchased $10 of paid credits — balance shows on dashboard
Confirmed an obviously-invalid key returns 401, so the 403 is specifically an authorization decision against my team
