AI SDK Harness Layer Adds Native Subscription Authentication Support

The harness layer of the AI SDK has introduced native subscription authentication, which is natively supported by the harnesses themselves. This allows developers to run and switch between various coding agents using the same HarnessAgent interface without modifying application code or adding new configurations.

Authentication modes are divided into three categories. The direct mode uses provider environment variable credentials if available, and falls back to native subscriptions discovered on the host if not. The default auto mode behaves identically to when no AI Gateway credentials are configured. In contrast, the ai-gateway mode never reads native subscriptions.

From a security perspective, native subscription credentials are kept only on the host. Similar to API keys, credentials are resolved at the host boundary, and OAuth access tokens are refreshed on the host when needed. In sandbox-supported environments, placeholder credentials are passed to the harness, while actual tokens are injected into outbound requests on the host.

This feature works with all harness adapters that support subscription login. Supported targets include:

• Claude Code
• Cline
• Codex
• Cursor
• fx
• GitHub Copilot
• Grok Build
• OpenCode
• Pi