Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: `google-vertex` provider ignores ADC credentials — throws 'No API key found' [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#56253•Fetched 2026-04-08 01:43:06
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Author
jasminehuang98613jasminehuang98613
Participants
jasminehuang98613jasminehuang98613
Timeline (top)
labeled ×2cross-referenced ×1referenced ×1

**Bug Report: google-vertex provider ignores ADC credentials — throws 'No API key found' **

Environment

  • OpenClaw version:v2026.3.23-2
  • OS: Windows (local) + Ubuntu 24.04 on AWS EC2
  • Provider: google-vertex
  • Models tested: google-vertex/gemini-2.5-flash, google-vertex/gemini-2.5-pro

Describe the bug

The google-vertex provider does not recognize GCP Application Default Credentials (ADC). Even when GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_CLOUD_PROJECT, and GOOGLE_CLOUD_LOCATION are correctly set and verified, OpenClaw throws:

No API key found for provider google-vertex

The error suggests OpenClaw's auth resolver for google-vertex expects a plain API key string (like GEMINI_API_KEY) instead of consuming GCP service account credentials via ADC.

Steps to Reproduce

  1. Create a GCP service account with Vertex AI User role
  2. Download the JSON key file
  3. Set environment variables:
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
export GOOGLE_CLOUD_PROJECT="your-gcp-project-id"
export GOOGLE_CLOUD_LOCATION="global"
  1. Verify ADC works:
gcloud auth activate-service-account --key-file="/path/to/service-account.json"
gcloud auth application-default print-access-token | head -c 20

✅ ADC token generates successfully

  1. Configure openclaw.json:
"model": {
  "primary": "google-vertex/gemini-2.5-flash",
  "fallbacks": ["google-vertex/gemini-2.5-pro"]
}
  1. Restart OpenClaw gateway and start a chat session

Result: No API key found for provider google-vertex

Expected behavior

OpenClaw should authenticate with Vertex AI using ADC (via GOOGLE_APPLICATION_CREDENTIALS) without requiring a plain API key, consistent with how Google Cloud SDKs handle service account auth.

Workaround

Currently using LiteLLM as a proxy bridge (litellm/gemini-vertex-flash) which correctly handles ADC and routes to Vertex AI. This works but requires running an additional service.

Error Message

The error suggests OpenClaw's auth resolver for google-vertex expects a plain API key string (like GEMINI_API_KEY) instead of consuming GCP service account credentials via ADC.

Root Cause

**Bug Report: google-vertex provider ignores ADC credentials — throws 'No API key found' **

Environment

  • OpenClaw version:v2026.3.23-2
  • OS: Windows (local) + Ubuntu 24.04 on AWS EC2
  • Provider: google-vertex
  • Models tested: google-vertex/gemini-2.5-flash, google-vertex/gemini-2.5-pro

Describe the bug

The google-vertex provider does not recognize GCP Application Default Credentials (ADC). Even when GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_CLOUD_PROJECT, and GOOGLE_CLOUD_LOCATION are correctly set and verified, OpenClaw throws:

No API key found for provider google-vertex

The error suggests OpenClaw's auth resolver for google-vertex expects a plain API key string (like GEMINI_API_KEY) instead of consuming GCP service account credentials via ADC.

Steps to Reproduce

  1. Create a GCP service account with Vertex AI User role
  2. Download the JSON key file
  3. Set environment variables:
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
export GOOGLE_CLOUD_PROJECT="your-gcp-project-id"
export GOOGLE_CLOUD_LOCATION="global"
  1. Verify ADC works:
gcloud auth activate-service-account --key-file="/path/to/service-account.json"
gcloud auth application-default print-access-token | head -c 20

✅ ADC token generates successfully

  1. Configure openclaw.json:
"model": {
  "primary": "google-vertex/gemini-2.5-flash",
  "fallbacks": ["google-vertex/gemini-2.5-pro"]
}
  1. Restart OpenClaw gateway and start a chat session

Result: No API key found for provider google-vertex

Expected behavior

OpenClaw should authenticate with Vertex AI using ADC (via GOOGLE_APPLICATION_CREDENTIALS) without requiring a plain API key, consistent with how Google Cloud SDKs handle service account auth.

Workaround

Currently using LiteLLM as a proxy bridge (litellm/gemini-vertex-flash) which correctly handles ADC and routes to Vertex AI. This works but requires running an additional service.

Fix Action

Fix / Workaround

Workaround

PR fix notes

PR #60860: feat(google): add Google Vertex AI provider with ADC auth and global endpoint routing

Description (problem / solution / changelog)

Summary

  • Registers a new google-vertex provider in the Google plugin that routes to aiplatform.googleapis.com using Application Default Credentials (ADC), separate from the existing google-gemini-cli OAuth path
  • Adds vertex-region.ts for region/project/baseUrl resolution (env vars + ADC file fallback), with global location producing the unprefixed aiplatform.googleapis.com endpoint
  • Adds vertex-provider-catalog.ts with the Gemini 3.x model catalog for Vertex AI
  • Updates the Google transport stream to detect Vertex endpoints and construct the correct project/location URL path (/v1/projects/{project}/locations/{location}/publishers/google/models/{model}:streamGenerateContent)
  • Exchanges ADC refresh token for a Bearer token at request time, handling the pi-ai "<authenticated>" sentinel that was previously sent as a literal API key causing 401s
  • Captures thought_signature from Gemini 3 thinking-mode tool call responses so multi-turn conversations replay correctly (fixes 400 INVALID_ARGUMENT on second turn)
  • Adds GCP_VERTEX_GOOGLE_CREDENTIALS_MARKER sentinel and registers google-vertex in openclaw.plugin.json

Closes #49039 Closes #56253 Closes #58775 Closes #60736

Test plan

  • pnpm test extensions/google/vertex-region.test.ts — 20 cases, all pass
  • pnpm test extensions/google/vertex-provider-catalog.test.ts — 7 cases, all pass
  • pnpm test src/infra/gemini-auth.test.ts — 5 cases, all pass
  • Live: google-vertex/gemini-3-flash-preview with GOOGLE_CLOUD_LOCATION=global and GOOGLE_CLOUD_PROJECT set — correct Vertex URL, Bearer auth, successful response

🤖 Generated with Claude Code

Changed files

  • extensions/google/api.ts (modified, +27/-9)
  • extensions/google/index.ts (modified, +86/-0)
  • extensions/google/openclaw.plugin.json (modified, +1/-1)
  • extensions/google/vertex-adc.ts (added, +92/-0)
  • extensions/google/vertex-provider-catalog.test.ts (added, +85/-0)
  • extensions/google/vertex-provider-catalog.ts (added, +116/-0)
  • extensions/google/vertex-region.test.ts (added, +173/-0)
  • extensions/google/vertex-region.ts (added, +116/-0)
  • src/agents/google-transport-stream.ts (modified, +112/-7)
  • src/agents/google-vertex-adc.ts (added, +99/-0)
  • src/agents/model-auth-env.ts (modified, +11/-6)
  • src/agents/model-auth-markers.ts (modified, +2/-0)
  • src/agents/pi-embedded-runner/stream-resolution.ts (modified, +7/-0)
  • src/infra/gemini-auth.test.ts (modified, +13/-0)
  • src/infra/gemini-auth.ts (modified, +14/-4)

Code Example

No API key found for provider google-vertex

---

export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
export GOOGLE_CLOUD_PROJECT="your-gcp-project-id"
export GOOGLE_CLOUD_LOCATION="global"

---

gcloud auth activate-service-account --key-file="/path/to/service-account.json"
gcloud auth application-default print-access-token | head -c 20

---

"model": {
  "primary": "google-vertex/gemini-2.5-flash",
  "fallbacks": ["google-vertex/gemini-2.5-pro"]
}

---
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

**Bug Report: google-vertex provider ignores ADC credentials — throws 'No API key found' **

Environment

  • OpenClaw version:v2026.3.23-2
  • OS: Windows (local) + Ubuntu 24.04 on AWS EC2
  • Provider: google-vertex
  • Models tested: google-vertex/gemini-2.5-flash, google-vertex/gemini-2.5-pro

Describe the bug

The google-vertex provider does not recognize GCP Application Default Credentials (ADC). Even when GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_CLOUD_PROJECT, and GOOGLE_CLOUD_LOCATION are correctly set and verified, OpenClaw throws:

No API key found for provider google-vertex

The error suggests OpenClaw's auth resolver for google-vertex expects a plain API key string (like GEMINI_API_KEY) instead of consuming GCP service account credentials via ADC.

Steps to Reproduce

  1. Create a GCP service account with Vertex AI User role
  2. Download the JSON key file
  3. Set environment variables:
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
export GOOGLE_CLOUD_PROJECT="your-gcp-project-id"
export GOOGLE_CLOUD_LOCATION="global"
  1. Verify ADC works:
gcloud auth activate-service-account --key-file="/path/to/service-account.json"
gcloud auth application-default print-access-token | head -c 20

✅ ADC token generates successfully

  1. Configure openclaw.json:
"model": {
  "primary": "google-vertex/gemini-2.5-flash",
  "fallbacks": ["google-vertex/gemini-2.5-pro"]
}
  1. Restart OpenClaw gateway and start a chat session

Result: No API key found for provider google-vertex

Expected behavior

OpenClaw should authenticate with Vertex AI using ADC (via GOOGLE_APPLICATION_CREDENTIALS) without requiring a plain API key, consistent with how Google Cloud SDKs handle service account auth.

Workaround

Currently using LiteLLM as a proxy bridge (litellm/gemini-vertex-flash) which correctly handles ADC and routes to Vertex AI. This works but requires running an additional service.

Steps to reproduce

na

Expected behavior

API key found for provider google-vertex`

Actual behavior

No API key found for provider google-vertex`

OpenClaw version

v2026.3.23-2

Operating system

UBUNTU

Install method

npm

Model

google-vertex/gemini-2.5-flash

Provider / routing chain

openclaw

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

Fix Plan

To fix the issue, we need to modify the google-vertex provider to use the Application Default Credentials (ADC) instead of expecting a plain API key.

Here are the steps:

  • Update the google-vertex provider to use the google-auth-library to authenticate with Vertex AI using ADC.
  • Modify the openclaw.json configuration to remove the API key requirement for the google-vertex provider.

Code Changes

# Import the google-auth-library
from google.oauth2 import service_account
from googleapiclient.discovery import build

# Load the ADC credentials
creds = service_account.Credentials.from_service_account_file(
    os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
    scopes=['https://www.googleapis.com/auth/cloud-platform']
)

# Create the Vertex AI client using the ADC credentials
vertex_ai_client = build('vertexai', 'v1', credentials=creds)

# Use the vertex_ai_client to authenticate with Vertex AI

Configuration Changes

// Remove the API key requirement from the openclaw.json configuration
"model": {
  "primary": "google-vertex/gemini-2.5-flash",
  "fallbacks": ["google-vertex/gemini-2.5-pro"],
  "auth": {
    "type": "adc"
  }
}

Verification

To verify the fix, restart the OpenClaw gateway and start a new chat session. The google-vertex provider should now authenticate with Vertex AI using the ADC credentials without requiring a plain API key.

Extra Tips

  • Make sure to set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of the service account JSON key file.
  • Verify that the ADC credentials are working correctly by running the gcloud auth activate-service-account and gcloud auth application-default print-access-token commands.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

API key found for provider google-vertex`

#api#model save/load#optimization#mixed precision#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: `google-vertex` provider ignores ADC credentials — throws 'No API key found' [1 pull requests, 1 participants]