VS Code’s Bring Your Own Key (BYOK) support lets developers use provider backed models in Chat without a Copilot plan. That can be useful when a team already has access to models through SAP AI Core and wants to work with them in VS Code.
There’s a small integration challenge with SAP AI Core service keys: they contain OAuth credentials and service URLs, not a standard model API key you can paste into a generic endpoint form. The client needs to exchange these credentials for an access token, then use that token and the correct resource group to make model requests.
I built SAPilot to handle those steps and make supported SAP AI Core deployments available in the VS Code Chat model picker.
What happens between Connect and Chat
After you enter your service key details, SAPilot stores the client secret in VS Code’s SecretStorage. The client ID, authentication URL, AI Core API URL, and resource group are stored separately as nonsecret connection settings. When SAPilot needs to call SAP AI Core, it requests an OAuth access token using the client credentials flow. The token is cached until shortly before it expires.
The exchange is the part that makes a service key different from a simple API key. This shortened example shows the same basic request SAPilot makes:
let tokenUrl = authUrl;
if (!tokenUrl.endsWith('/oauth/token')) tokenUrl += '/oauth/token';
const response = await fetch(`${tokenUrl}?grant_type=client_credentials`, {
method: 'POST',
redirect: 'error',
headers: {
Authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`
}
});
if (!response.ok) throw new Error(`SAP sign-in failed: ${response.status}`);
const { access_token: accessToken, expires_in: expiresIn } = await response.json();For a chat request, SAPilot sends the access token as a bearer token and adds the AI-Resource-Group header. It also discovers running deployments and chooses a compatible request format for each supported chat model. This is why connecting SAP AI Core takes more than entering a base URL and a key.
A small security decision with a practical effect
A design choice was where to persist the values entered during setup. SAPilot uses VS Code’s SecretStorage for the client secret and globalState for the client ID and endpoint details. VS Code documents SecretStorage as encrypted storage for sensitive values, while extension state is intended for ordinary key-value data. Keeping the secret out of ordinary configuration avoids writing it alongside nonsecret settings.
This choice also affects setup: the secret is stored locally through VS Code and is not synced between machines, so you enter it again on another machine. SAPilot never needs a shared credential embedded in the extension; each developer connects using their own service key. Prompts and chat context are sent to the SAP AI Core model selected in Chat, so the model and service key should be chosen according to your organization’s data and access policies.
Why use the Chat Provider API?
VS Code’s Language Model Chat Provider API lets an extension contribute models to the existing picker and handle requests for them. SAPilot registers a provider, looks up deployments available to the connected service key, and returns the supported chat deployments to VS Code. When you select one, the extension translates the chat messages into that model’s request format and streams the response back into Chat.
That provider layer is useful here because SAP AI Core can expose different model families and request formats. SAPilot currently handles supported OpenAI compatible Chat Completions, Claude, Bedrock Converse, Cohere Chat, and Gemini on Vertex AI deployments. Deployments that are not supported chat models, such as embeddings, are left out of the picker.
The result is a familiar workflow: connect once, open Chat, and select an SAP AI Core deployment. You do not need to copy an access token into VS Code or manually add a resource-group header for every request.
Getting started and scope
Install SAPilot in VS Code 1.104 or later, run SAPilot: Connect to SAP AI Core, and enter your service key details. You need permission to use a running chat deployment. Then open Chat and select a model under SAP AI Core.
BYOK makes this chat workflow available without a Copilot plan, but model usage still follows the billing terms of your SAP AI Core account. Some VS Code capabilities, including inline suggestions and semantic search, remain tied to GitHub or Copilot services. Model cost, quality, and speed depend on the deployment, usage, and task.
A takeaway and what’s next
SAPilot shows how VS Code’s BYOK support can connect developers to models their organization already provides through SAP AI Core. BYOK changes which service handles chat requests; model usage still follows your SAP AI Core billing and your organization’s data policies. If you try SAPilot, have a question, or would like to suggest a feature, let me know in the comments. You can also contribute by raising a pull request on GitHub.
Bluesky
