Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: ADC authorized_user flow broken in Docker due to @google/genai SDK mismatch` [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#74628•Fetched 2026-04-30 06:22:01
View on GitHub
Comments
1
Participants
2
Timeline
6
Reactions
0
Author
frankhal2001-designfrankhal2001-design
Participants
frankhal2001-designfrankhal2001-designyetvalyetval
Timeline (top)
labeled ×2referenced ×2commented ×1cross-referenced ×1

When using the google-vertex provider with ADC authorized_user credentials in a Docker container, OpenClaw crashes on startup (TypeError: Cannot convert undefined or null to object) because the @google/genai SDK does not support this auth flow cleanly.

Root Cause

When using the google-vertex provider with ADC authorized_user credentials in a Docker container, OpenClaw crashes on startup (TypeError: Cannot convert undefined or null to object) because the @google/genai SDK does not support this auth flow cleanly.

Fix Action

Fix / Workaround

Affected: Users deploying OpenClaw in Docker with standard developer Google accounts (ADC `authorized_user`) instead of Service Accounts.
Severity: High (Blocks workflow; agent cannot start).
Frequency: Always on 2026.4.21.
Consequence: Cannot authenticate to Vertex AI without manual source patching.

Last known good versions allowed raw REST endpoints. Current workaround is patching google-vertex.js to manually intercept the authorized_user JSON file, perform a direct REST POST to the Google OAuth2 token endpoint to exchange the refresh_token for a short-lived Bearer token, and then initializing the createClient() instance using the raw token header. Native fallback logic would resolve this.

PR fix notes

PR #74657: fix(google-vertex): support authorized_user ADC credentials

Description (problem / solution / changelog)

Summary

Closes #74628.

The @google/genai SDK (v1.50.1) only handles service-account ADC cleanly. When GOOGLE_APPLICATION_CREDENTIALS points to an authorized_user JSON (the default produced by gcloud auth application-default login, common in Docker dev setups), the SDK throws:

TypeError: Cannot convert undefined or null to object
    at createClient (google-vertex.js)

…because it iterates fields that only exist on service-account credentials.

This PR adds first-class support for authorized_user ADC by minting a short-lived Bearer token via the OAuth2 refresh_token grant and injecting it as an Authorization header on the GoogleGenAI client, bypassing the SDK's broken credential resolver for this case.

Changes

  • extensions/google/adc-credentials.ts (new) — load + parse ADC JSON, mint access tokens via https://oauth2.googleapis.com/token, in-memory cache with 60 s safety skew.
  • extensions/google/google-genai-runtime.ts — new createGoogleVertexGenAI() async helper that detects authorized_user, mints a token, and injects httpOptions.headers.Authorization. Service-account and "no creds" paths are unchanged.
  • extensions/google/adc-credentials.test.ts (new) — vitest covering shape detection, missing-field errors, token POST body, error responses, cache hit/expiry.

Behavior

ADC typeBeforeAfter
service_accountWorksUnchanged
authorized_userCrash on startup (TypeError)Token minted + injected; client initializes
missing / no pathSDK default behaviorUnchanged

GOOGLE_CLOUD_PROJECT (or GCLOUD_PROJECT, or quota_project_id in the JSON) is now required for authorized_user since the JSON has no project_id. A clear error is thrown if absent.

Follow-up (not in this PR)

createGoogleVertexGenAI needs to be wired into the chat-completion code path that produces the stack trace in #74628. Current createGoogleGenAI callers (video / realtime / music) don't pass vertexai: true, so the crashing call site lives elsewhere — happy to extend in a follow-up once a maintainer points to it, or in this PR if preferred.

Test plan

  • pnpm -C extensions/google test adc-credentials (unit tests)
  • Manual: Docker container, authorized_user ADC mounted at /run/secrets/gcloud-adc.json, GOOGLE_CLOUD_PROJECT + GOOGLE_CLOUD_LOCATION=global set — confirm OpenClaw initializes against gemini-3.1-pro-preview
  • Manual: same flow with a service-account ADC — confirm unchanged behavior
  • Manual: authorized_user ADC without GOOGLE_CLOUD_PROJECT — confirm the new error is raised

Changed files

  • extensions/google/adc-credentials.test.ts (added, +178/-0)
  • extensions/google/adc-credentials.ts (added, +119/-0)
  • extensions/google/google-genai-runtime.ts (modified, +67/-0)
  • extensions/google/transport-stream.test.ts (modified, +79/-0)
  • extensions/google/transport-stream.ts (modified, +17/-3)
  • extensions/google/vertex-adc-auth.test.ts (added, +78/-0)
  • extensions/google/vertex-adc-auth.ts (added, +41/-0)

Code Example

Affected: Users deploying OpenClaw in Docker with standard developer Google accounts (ADC `authorized_user`) instead of Service Accounts.
Severity: High (Blocks workflow; agent cannot start).
Frequency: Always on 2026.4.21.
Consequence: Cannot authenticate to Vertex AI without manual source patching.
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

When using the google-vertex provider with ADC authorized_user credentials in a Docker container, OpenClaw crashes on startup (TypeError: Cannot convert undefined or null to object) because the @google/genai SDK does not support this auth flow cleanly.

Steps to reproduce

  1. Configure openclaw.json with the google-vertex provider and vertexai: true.
  2. Map a valid authorized_user ADC JSON file into a Docker container.
  3. Set GOOGLE_APPLICATION_CREDENTIALS to the path of that JSON file.
  4. Launch OpenClaw 2026.4.21.

Expected behavior

OpenClaw initializes the createClient() instance and successfully authenticates using the refresh token present in the authorized_user ADC file, mirroring behavior of previous SDK versions or direct REST flows.

Actual behavior

The process crashes entirely with: TypeError: Cannot convert undefined or null to object at createClient (google-vertex.js)

OpenClaw version

2026.4.21

Operating system

Docker container Linux arm64 (macOS M3 Pro Host)

Install method

docker

Model

google-vertex/gemini-3.1-pro-preview

Provider / routing chain

openclaw -> google-vertex

Additional provider/model setup details

  • Credentials: authorized_user ADC credentials mounted as a volume at /run/secrets/gcloud-adc.json
  • Env Vars: GOOGLE_CLOUD_LOCATION=global

Logs, screenshots, and evidence

Affected: Users deploying OpenClaw in Docker with standard developer Google accounts (ADC `authorized_user`) instead of Service Accounts.
Severity: High (Blocks workflow; agent cannot start).
Frequency: Always on 2026.4.21.
Consequence: Cannot authenticate to Vertex AI without manual source patching.

Impact and severity

No response

Additional information

Last known good versions allowed raw REST endpoints. Current workaround is patching google-vertex.js to manually intercept the authorized_user JSON file, perform a direct REST POST to the Google OAuth2 token endpoint to exchange the refresh_token for a short-lived Bearer token, and then initializing the createClient() instance using the raw token header. Native fallback logic would resolve this.

extent analysis

TL;DR

The most likely fix is to patch the google-vertex.js file to manually handle the authorized_user authentication flow.

Guidance

  • Verify that the authorized_user ADC JSON file is correctly mounted and the GOOGLE_APPLICATION_CREDENTIALS environment variable is set to the correct path.
  • Check the google-vertex.js file for any existing patches or workarounds that may be causing conflicts.
  • Consider implementing a native fallback logic to handle the authentication flow, as mentioned in the additional information section.
  • Test the workaround by manually intercepting the authorized_user JSON file and exchanging the refresh_token for a short-lived Bearer token using a direct REST POST to the Google OAuth2 token endpoint.

Example

// Example patch for google-vertex.js
const fs = require('fs');
const axios = require('axios');

// Load the authorized_user JSON file
const adcJson = fs.readFileSync('/run/secrets/gcloud-adc.json', 'utf8');
const adcData = JSON.parse(adcJson);

// Exchange the refresh token for a short-lived Bearer token
axios.post('https://accounts.google.com/o/oauth2/token', {
  grant_type: 'refresh_token',
  refresh_token: adcData.refresh_token,
  client_id: adcData.client_id,
  client_secret: adcData.client_secret,
})
.then(response => {
  const bearerToken = response.data.access_token;
  // Initialize the createClient instance using the raw token header
  const client = createClient({ headers: { Authorization: `Bearer ${bearerToken}` } });
  // ...
});

Notes

The provided workaround is specific to the google-vertex provider and authorized_user ADC credentials. This solution may not be applicable to other providers or authentication flows.

Recommendation

Apply the workaround by patching the google-vertex.js file to manually handle the authorized_user

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

OpenClaw initializes the createClient() instance and successfully authenticates using the refresh token present in the authorized_user ADC file, mirroring behavior of previous SDK versions or direct REST flows.

#ssr#cache issue#memory leak#API versioning#request timeout

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: ADC authorized_user flow broken in Docker due to @google/genai SDK mismatch` [1 pull requests, 1 comments, 2 participants]