Authentication

All Vertex AI models support multiple authentication methods via Google Cloud credentials.

Automatic Discovery (Recommended)

Models automatically discover credentials from environment using Default Application Credentials:

VertexAiChatModel model = VertexAiChatModel.builder()
    .endpoint("https://us-central1-aiplatform.googleapis.com/v1/")
    .project("your-project-id")
    .location("us-central1")
    .publisher("google")
    .modelName("chat-bison@001")
    .build();  // No credentials specified - uses auto-discovery

Credential Discovery Order

Default Application Credentials checks in this order:

1. GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to service account key file
2. Google Cloud SDK credentials from gcloud auth application-default login
3. Compute Engine/GKE service account (when running on GCP)
4. Cloud Functions/Cloud Run service account (when running on GCP)

Environment Variable Method

Set the path to your service account key file:

export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"

Then build models normally (no credentials parameter needed):

VertexAiChatModel model = VertexAiChatModel.builder()
    .endpoint("https://us-central1-aiplatform.googleapis.com/v1/")
    .project("your-project-id")
    .location("us-central1")
    .publisher("google")
    .modelName("chat-bison@001")
    .build();

Google Cloud SDK Method

For local development, authenticate using gcloud CLI:

gcloud auth application-default login

This stores credentials locally that models will automatically discover.

Programmatic Credentials

For custom credential management, provide GoogleCredentials explicitly:

import com.google.auth.oauth2.GoogleCredentials;
import java.io.FileInputStream;

GoogleCredentials credentials = GoogleCredentials.fromStream(
    new FileInputStream("/path/to/service-account.json")
);

VertexAiChatModel model = VertexAiChatModel.builder()
    .endpoint("https://us-central1-aiplatform.googleapis.com/v1/")
    .project("your-project-id")
    .location("us-central1")
    .publisher("google")
    .modelName("chat-bison@001")
    .credentials(credentials)  // Explicit credentials
    .build();

Service Account from InputStream

GoogleCredentials credentials = GoogleCredentials.fromStream(inputStream);

Service Account with Scopes

GoogleCredentials credentials = GoogleCredentials.fromStream(
    new FileInputStream("/path/to/service-account.json")
).createScoped("https://www.googleapis.com/auth/cloud-platform");

Service Account from JSON String

import java.io.ByteArrayInputStream;

String jsonKey = "{ ... service account JSON ... }";
GoogleCredentials credentials = GoogleCredentials.fromStream(
    new ByteArrayInputStream(jsonKey.getBytes())
);

Models Supporting Custom Credentials

Custom credentials via credentials() builder method are supported by:

• VertexAiChatModel ✓
• VertexAiLanguageModel ✗ (uses default credentials only)
• VertexAiEmbeddingModel ✓
• VertexAiImageModel ✗ (uses default credentials only)
• VertexAiScoringModel ✗ (uses default credentials only)

For models without credentials() support, use environment variable or gcloud SDK methods.

Service Account Permissions

Your service account needs these IAM roles:

roles/aiplatform.user

Or these specific permissions:

aiplatform.endpoints.predict
aiplatform.models.predict

Troubleshooting

ADC Not Found

Error: "Application Default Credentials are not available"

Solutions:

1. Set GOOGLE_APPLICATION_CREDENTIALS environment variable
2. Run gcloud auth application-default login
3. Ensure running on GCP with service account attached

Permission Denied

Error: "Permission denied" or "403 Forbidden"

Solutions:

1. Verify service account has roles/aiplatform.user role
2. Check project ID matches the one where service account has permissions
3. Ensure Vertex AI API is enabled in the project

Invalid Credentials

Error: "Could not load credentials" or "Invalid key format"

Solutions:

1. Verify service account key file is valid JSON
2. Check file path is correct and accessible
3. Ensure key hasn't been deleted or rotated in GCP Console

Best Practices

1. Production: Use service accounts with minimal required permissions
2. Development: Use gcloud auth application-default login for convenience
3. CI/CD: Use service account keys stored securely (e.g., GitHub Secrets)
4. Container/K8s: Use Workload Identity instead of key files
5. Never commit: Don't commit service account keys to version control