Wire deny.sh into the Vercel AI SDK in 30 lines.

// npm install ai @ai-sdk/openai deny-sh@^2.0.4
// app/api/agent/route.ts
import { generateText, tool, stepCountIs } from 'ai';
import { openai } from '@ai-sdk/openai';
import { vaultGet } from 'deny-sh/client';
import { z } from 'zod';

const getInvoice = tool({
  description: 'Look up a Stripe invoice by id',
  inputSchema: z.object({ id: z.string() }),
  async execute({ id }) {
    // resolve the credential INSIDE the tool boundary
    const stripeKey = await vaultGet('stripe-prod', process.env.VAULT_PW!);
    const r = await fetch(`https://api.stripe.com/v1/invoices/${id}`, {
      headers: { Authorization: `Bearer ${stripeKey}` }
    });
    // narrowed DTO: never return raw upstream JSON, error bodies, headers,
    // or stack traces. Pick only the fields the model needs.
    if (!r.ok) return { error: 'invoice_lookup_failed', status: r.status };
    const body = await r.json();
    return { id: body.id, amount_due: body.amount_due, status: body.status };
  }
});

export async function POST(req: Request) {
  const { messages } = await req.json();
  const { text } = await generateText({
    model: openai('gpt-5.4'),
    tools: { getInvoice },
    messages,
    // multi-step: feed tool results back so the model can produce a final answer
    stopWhen: stepCountIs(5),
  });
  return Response.json({ text });
}

const getInvoiceFor = (tenantId: string, tenantPw: string) => tool({
  description: 'Look up an invoice for the current tenant',
  inputSchema: z.object({ id: z.string() }),
  async execute({ id }) {
    const stripeKey = await vaultGet('stripe-prod', tenantPw, {
      apiKey: tenantKeyFor(tenantId), // per-tenant deny.sh key
    });
    const r = await fetch(`https://api.stripe.com/v1/invoices/${id}`, {
      headers: { Authorization: `Bearer ${stripeKey}` }
    });
    if (!r.ok) return { error: 'invoice_lookup_failed', status: r.status };
    const body = await r.json();
    return { id: body.id, amount_due: body.amount_due, status: body.status };
  }
});