@ai-sdk/zai 3.0.44 Released: Credentials Now Support Async Callbacks

The Z.ai (Zhipu AI) provider package in the AI SDK ecosystem has received patch version 3.0.44. Although the version number only bumped by a single patch digit, this update touches a critical part of the authentication chain: the provider's API Key and token configuration now supports Promises as well as synchronous/asynchronous callback functions, and credentials are resolved in real time on every authenticated request. For applications that dynamically switch keys at runtime or pull temporary tokens from a secrets management service, this is a change whose practical value far exceeds what the version number suggests.

The Authentication Mechanism Change Behind the Patch

According to the release notes, the core change in 3.0.44 revolves around how provider credentials are resolved. Previously, API Keys and tokens were typically configured as static strings; this update allows passing in a Promise, or a synchronous/asynchronous callback function. More importantly, credential resolution now happens on "every authenticated request" rather than being read once at initialization. This means applications can obtain the latest credentials before a request is sent, without needing to rebuild the provider instance.

The release notes also emphasize that this change is "preserving existing authentication behavior and synchronous credential serialization" — existing authentication behavior and synchronous credential serialization remain compatible. In other words, the old approach of passing a string directly is unaffected in existing projects; the new capability is purely additive. This is especially important for existing applications that depend on the AI SDK, since a patch-level update should not introduce breaking migrations.

AI SDK (formerly Vercel AI SDK) is a TypeScript toolkit for large model applications that abstracts different model providers through a unified interface, letting developers integrate OpenAI, Anthropic, Google, Zhipu Z.ai, and many other services using a consistent calling convention. "Provider" is a core abstraction concept in the AI SDK: each provider package is responsible for encapsulating a vendor's authentication method, request format, and response parsing, and exposes model instances for upper layers to call. @ai-sdk/zai is the official adapter package for Zhipu AI in the ecosystem; developers create a provider instance and pass in an API Key to obtain a usable language model object. Because the provider serves as the entry point of the authentication chain, any adjustment to how credentials are configured — for example, expanding from a static string to asynchronously resolvable — directly affects how applications manage the key lifecycle.

"Credential serialization" has a specific meaning in the AI SDK's provider system: provider instances often need to be cached, passed between server components, or written into certain runtime contexts, in which case the credential field must be reliably serializable as plain data. When a credential is a pending Promise or a callback function, serializing it directly would lose its executability, so the SDK needs to design a separate resolution and caching strategy for async credentials while preserving the synchronous string path. The emphasis in the release notes on "preserving synchronous credential serialization" is precisely to clarify that legacy string credentials can still be safely serialized, while the newly added Promise/callback forms belong to a separate resolution channel. Understanding this distinction helps determine under which deployment scenarios using async credentials is safe.

Usage Constraints for Async WebSocket Configuration

The same version also adjusted the getServerWebSocketConfig() method in the experimental OpenAI Live feature. The method now allows returning results asynchronously, but the release notes give an explicit usage constraint: you need to await its return value before obtaining the connection settings. Changes of this kind — where the method signature is relaxed but the caller must cooperate — are easy to overlook during upgrades. If your project uses OpenAI Live's WebSocket configuration, check after upgrading whether the call site correctly handles the async return; otherwise you may read an incomplete configuration object when establishing the connection.

Dependency Sync and Upgrade Recommendations

This release also comes with several dependency updates, including @ai-sdk/openai-compatible@3.0.82, @ai-sdk/provider-utils@5.0.72, and @ai-sdk/provider@4.0.35. These dependencies belong to the same commit chain as the credential resolution logic, indicating that the changes were advanced in coordination between the provider abstraction layer and the compatibility layer.

For teams using @ai-sdk/zai, the upgrade barrier is low: conventional static configuration requires no changes, and you only need to check two things — whether you want to switch credentials to runtime async resolution, and whether you call getServerWebSocketConfig() in the experimental WebSocket feature. The former is an optional enhancement; the latter is a compatibility point that needs to be confirmed. Patch versions usually do not introduce API breaks, but once a method that "can be async" is mistakenly used synchronously, problems often surface only on specific request paths, making troubleshooting more costly.

Summary

3.0.44 is a patch update centered on the authentication chain: credential configuration moves from static to asynchronously resolvable and per-request resolution while remaining backward compatible; the experimental WebSocket configuration method gains async capability but requires callers to await. For most projects this is a low-risk upgrade, and what truly deserves attention is how calls are written at async boundaries.

Background Notes

OpenAI Live is an experimental feature in the AI SDK for real-time interactive scenarios, typically referring to establishing a long-lived connection with a model over WebSocket for low-latency streaming interactions such as voice conversations and real-time transcription. getServerWebSocketConfig() is responsible for returning the configuration needed to establish a connection on the server side, such as the address, authentication headers, and protocol parameters. Because this capability is still marked experimental, its method signature may change in patch versions, and there is no long-term stability commitment regarding its semantics either. Changing such methods to allow async returns is often because the configuration needs to be obtained from an external service (such as a temporary token issuance endpoint); but callers of experimental APIs already face higher upgrade friction and must weigh pinning dependency versions against actively keeping up.