Gemini CLI Vertex AI Authentication Bug - CREDENTIALS_MISSING Despite Valid Service Account

[sleepingforest1024]

What happened?

Gemini CLI v0.24.0-nightly fails to authenticate using BOTH documented authentication methods (OAuth and Vertex AI) when attempting to use a Gemini Code Assist Standard subscription.

Authentication Method 1: OAuth ("Login with Google") - FAILED

• Selected "1. Login with Google" during Gemini CLI startup
• Completed browser authentication flow successfully
• Authenticated with account: cyril@slxxxxxxxxxxxk (has active Code Assist Standard license)
• Result: Authentication succeeds but CLI shows free-tier quota limits instead of Code Assist subscription limits (1,500 req/day)
• /stats shows: 98.3% quota used on free tier, daily resets
• Issue: OAuth does not recognize or apply the Code Assist Standard subscription

Authentication Method 2: Vertex AI (Service Account) - FAILED

• Selected "3. Vertex AI" during Gemini CLI startup
• Configured service account with proper IAM roles and credentials
• Result: Persistent 401 CREDENTIALS_MISSING error on every API call despite correct configuration
• Debug console shows "Authenticated via 'vertex-ai'" but API calls fail immediately

Observed behavior and evidence:

Method 1: OAuth Authentication Attempt

Configuration:

• Started Gemini CLI and selected "1. Login with Google"
• Completed browser OAuth flow with cyril@slxxxxxxxxxxxk
• Account has active Code Assist Standard subscription (verified in billing console)
• ~/.gemini/settings.json shows: "selectedType": "oauth-personal"
• ~/.gemini/google_accounts.json shows: "active": "cyril@slxxxxxxxxxxxk"

Result:

• Authentication succeeds (no errors)
• Gemini CLI starts and accepts prompts
• /stats output shows:

  gemini-2.5-flash       -   98.3% (Resets in 23h)
  gemini-2.5-pro         -    0.0% (Resets in 1h 48m)
  
  Usage limits span all sessions and reset daily.
  /auth to upgrade or switch to API key.
  

• These are FREE TIER limits, not Code Assist Standard limits (which should be 1,500 req/day)
• Issue: OAuth authentication does not recognize or apply the Code Assist subscription quota

Method 2: Vertex AI Service Account Authentication Attempt

Authentication Configuration:

• Gemini CLI settings show: "selectedType": "vertex-ai" (verified in ~/.gemini/settings.json)
• Debug console confirms: "Authenticated via 'vertex-ai'"
• Service account created: gemini-cli-service-account@sleepingforest-464615.iam.gserviceaccount.com
• IAM role granted: "Vertex AI User" (verified in Google Cloud Console)
• Vertex AI API enabled for project sleepingforest-464615
• Environment variables correctly set:
  • GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json
  • GOOGLE_CLOUD_PROJECT=sleepingforest-464615
  • GOOGLE_CLOUD_LOCATION=us-central1
  • GOOGLE_GENAI_USE_VERTEXAI=true
• Python verification confirms credentials load correctly:

  from google.auth import default
  creds, project = default()
  print(creds.service_account_email)  # Prints correct service account

Error received on every API call:

API Error: 401 UNAUTHENTICATED
{
  "error": {
    "code": 401,
    "message": "API keys are not supported by this API. Expected OAuth2 access token or other authentication credentials that assert a principal.",
    "status": "UNAUTHENTICATED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "CREDENTIALS_MISSING",
        "domain": "googleapis.com",
        "metadata": {
          "method": "google.cloud.aiplatform.v1beta1.PredictionService.StreamGenerateContent",
          "service": "aiplatform.googleapis.com"
        }
      }
    ]
  }
}

Key observation: The error message "API keys are not supported by this API" suggests Gemini CLI is either:

1. Sending an API key instead of the service account token, or
2. Not sending any credentials at all (hence "CREDENTIALS_MISSING")

Steps to reproduce:

Reproduction Path 1: OAuth Authentication (Fails to recognize subscription)

1. Start Gemini CLI: gemini --model gemini-3-pro-preview
2. Select "1. Login with Google"
3. Complete browser authentication with cyril@slxxxxxxxxxxxk
4. Wait for CLI to start successfully
5. Run /stats command
6. Observe: Free tier quota limits shown (98.3% used) instead of Code Assist Standard quota (1,500 req/day)
7. Result: OAuth succeeds but subscription not recognized

Reproduction Path 2: Vertex AI Authentication (Fails with CREDENTIALS_MISSING)

Environment:

• OS: Linux (Ubuntu)
• Gemini CLI version: 0.24.0-nightly.20251231.05049b5ab
• gcloud SDK: 550.0.0
• Google Cloud project: sleepingforest-464615
• Subscription: Gemini Code Assist Standard ($22.80/month, active)

Setup steps:

1. Create service account with "Vertex AI User" role in Google Cloud Console
2. Download service account JSON key to /path/to/gemini-cli.json
3. Enable Vertex AI API for the project
4. Configure environment:

   export GOOGLE_APPLICATION_CREDENTIALS=/path/to/gemini-cli.json
   export GOOGLE_CLOUD_PROJECT=sleepingforest-464615
   export GOOGLE_CLOUD_LOCATION=us-central1
   export GOOGLE_GENAI_USE_VERTEXAI=true
   unset GOOGLE_API_KEY
   unset GEMINI_API_KEY

5. Start Gemini CLI: gemini --model gemini-3-pro-preview
6. When prompted for authentication, select "3. Vertex AI"
7. Verify settings: Check ~/.gemini/settings.json shows "selectedType": "vertex-ai"
8. Send any message to Gemini (e.g., "hello")
9. Observe: Debug console (F12) shows "Authenticated via 'vertex-ai'" but API call fails with CREDENTIALS_MISSING

Alternative reproduction using gcloud ADC:

1. Install gcloud SDK
2. Run: gcloud auth activate-service-account --key-file=/path/to/gemini-cli.json
3. Run: gcloud config set project sleepingforest-464615
4. Create ADC symlink: ln -sf /path/to/gemini-cli.json ~/.config/gcloud/application_default_credentials.json
5. Verify ADC works: gcloud auth application-default print-access-token (succeeds)
6. Start Gemini CLI with Vertex AI authentication
7. Same error occurs

Impact:

Critical issue for Code Assist Standard users:

• OAuth authentication ("Login with Google"): Succeeds but does not recognize Code Assist subscriptions (related to known issues Browser-based auth fails to apply Code Assist subscription, uses wrong project #4723, Gemini CLI not seeing my code assist standard license #5543)
  • User stuck on free tier quota limits
  • Subscription ($22.80/month) goes unused
• Vertex AI authentication (Service Account): Claims authentication success but fails with CREDENTIALS_MISSING on every API call
  • Cannot make any API requests
  • Renders Gemini CLI completely unusable
• API Key authentication method: Untested for Code Assist subscription recognition
• Result: ZERO working authentication methods exist for paid Code Assist Standard subscribers to use Gemini CLI with their subscription

User experience:

• Paid subscription ($22.80/month) cannot be used with Gemini CLI
• Multiple hours spent troubleshooting with correct configuration
• All official documentation steps followed, yet service remains unusable

What did you expect to happen?

Gemini CLI should:

1. Load service account credentials from GOOGLE_APPLICATION_CREDENTIALS environment variable
2. Generate OAuth2 access token from the service account credentials using Google Auth libraries
3. Attach the access token to Vertex AI API requests in the Authorization header
4. Successfully authenticate with aiplatform.googleapis.com using the service account's "Vertex AI User" permissions
5. Apply Code Assist subscription quota (1,500 requests/day for Standard tier) to API usage
6. Return successful responses from the Gemini model instead of authentication errors

Specifically for the "Authenticated via 'vertex-ai'" status:

• If the debug console shows this message, the CLI should have already loaded credentials
• The subsequent API call should include those credentials
• The error should NOT be "CREDENTIALS_MISSING" if authentication was truly successful

Client information

Gemini CLI version:

0.24.0-nightly.20251231.05049b5ab

Operating System:

Linux (Ubuntu)
Kernel: 6.8.0-90-generic

Node.js version:

v20.19.6 (via NVM)

Google Cloud SDK version:

Google Cloud SDK 550.0.0
core 2025.12.12

Python version (for credential testing):

Python 3.11 (Anaconda)
google-auth library installed

Subscription details:

• Product: Gemini Code Assist Standard
• Cost: $22.80/month
• Subscription ID: 731d7845-2a9c-4a44-b520-9e2463684bf2
• Billing Account: 01FE31-2A85A7-B49508
• License assigned to: cyril@slxxxxxxxxxxxk

Login information

Authentication Method 1: Google Account (OAuth)

• Login type: "Login with Google" option in Gemini CLI
• Account: cyril@slxxxxxxxxxxxk
• Account type: Google Workspace Standard account
• Subscription: Gemini Code Assist Standard (active, $22.80/month)
• Billing Account: 01FE31-2A85A7-B49508
• Project: sleepingforest-464615
• Status: Authentication succeeds, but subscription quota NOT recognized
• Settings file shows: "selectedType": "oauth-personal"
• Result: Shows free tier limits instead of Code Assist quota

Authentication Method 2: Vertex AI (Service Account)

• Login type: "Vertex AI" option in Gemini CLI
• Service Account: gemini-cli-service-account@sleepingforest-464615.iam.gserviceaccount.com
• Authentication method: Service account JSON key file
• IAM Role: "Vertex AI User" (roles/aiplatform.user)
• Project: sleepingforest-464615
• Credentials source: GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to JSON key
• Status: Debug console shows "Authenticated via 'vertex-ai'" but API calls fail
• Settings file shows: "selectedType": "vertex-ai"
• Result: 401 CREDENTIALS_MISSING error on all API requests

Authentication Method 3: API Key

• Status: Not attempted
• Reason: Unclear if API key method will recognize Code Assist subscription quota

Anything else we need to know?

This affects Code Assist Standard subscribers specifically:

We systematically tested ALL THREE documented authentication methods:

1. OAuth method (documented as primary authentication):

   • Status: Authentication succeeds
   • Issue: Does not recognize Code Assist subscription, shows free tier limits
   • Related to existing bugs Browser-based auth fails to apply Code Assist subscription, uses wrong project #4723, Gemini CLI not seeing my code assist standard license #5543
   • Result: CLI works but subscription quota not applied

2. Vertex AI method (documented as alternative for enterprise/workspace users):

   • Status: Debug console claims "Authenticated via 'vertex-ai'"
   • Issue: API calls fail with CREDENTIALS_MISSING
   • Configuration verified correct (service account, IAM roles, environment variables)
   • Result: CLI completely unusable, zero API calls succeed

3. API Key method:

   • Status: Not attempted
   • Reason: Unknown if API keys recognize Code Assist subscription quota
   • Risk: May incur pay-per-use charges instead of using subscription

Conclusion: No working authentication method exists for using Gemini CLI with Code Assist Standard subscription

Root cause hypothesis:

Based on the error "API keys are not supported by this API" combined with "CREDENTIALS_MISSING", one of the following is likely occurring:

1. Credential loading failure: Gemini CLI's Vertex AI authentication module is not properly reading GOOGLE_APPLICATION_CREDENTIALS or gcloud ADC
2. Token generation failure: The CLI successfully loads the service account JSON but fails to exchange it for an OAuth2 access token
3. Token transmission failure: The CLI generates a valid token but fails to attach it to the Vertex AI API request headers
4. Environment variable priority issue: Some other environment variable (e.g., GOOGLE_API_KEY from .gemini/.env file) is overriding the service account credentials

Verification that credentials work outside Gemini CLI:

We confirmed the service account credentials are valid by:

• Using Python's google.auth.default() to load credentials successfully
• Running gcloud auth application-default print-access-token successfully
• Verifying IAM permissions in Google Cloud Console
• Testing that the service account has necessary Vertex AI API access

Related issues:

• Browser-based auth fails to apply Code Assist subscription, uses wrong project #4723: OAuth authentication fails to detect Code Assist subscriptions
• Gemini CLI not seeing my code assist standard license #5543: Code Assist licenses not recognized with OAuth login

Full conversation and debugging logs available upon request.

This issue is blocking paid subscribers from using Gemini CLI with their Code Assist Standard subscriptions. Any guidance on correct authentication configuration or timeline for a fix would be greatly appreciated.

[gemini-cli]

Hello! As part of our effort to keep our backlog manageable and focus on the most active issues, we are tidying up older reports.

It looks like this issue hasn't been active for a while, so we are closing it for now. However, if you are still experiencing this bug on the latest stable build, please feel free to comment on this issue or create a new one with updated details.

Thank you for your contribution!