fix(auth): improve Vertex AI 401 error message when using standard AP… - #28679
fix(auth): improve Vertex AI 401 error message when using standard AP…#28679SHAI-nikhil-chaudhary wants to merge 5 commits into
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the developer experience for Vertex AI authentication by replacing cryptic 401 errors with clear, actionable feedback. By validating credentials before initiating network requests, the system now prevents misconfiguration issues and guides users toward the correct authentication methods. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
📊 PR Size: size/S
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a proactive validation check to throw an error when attempting to use Vertex AI with only a standard Gemini API key, along with a corresponding unit test. The reviewer points out that this check introduces false positives for users relying on ambient Google Cloud credentials (ADC) who also have a GEMINI_API_KEY set. The reviewer suggests removing this validation and instead temporarily stripping GEMINI_API_KEY from process.env during client initialization to prevent the SDK from falling back to it, which would also require removing the newly added test.
| if (authType === AuthType.USE_VERTEX_AI) { | ||
| if (geminiApiKey && !googleApiKey && !(googleCloudProject && googleCloudLocation)) { | ||
| throw new Error( | ||
| 'Authentication failed: You are attempting to use the Vertex AI endpoint with a standard Gemini API key. ' + | ||
| 'Vertex AI requires Google Cloud credentials. Please authenticate using standard Google Cloud methods ' + | ||
| '(e.g., `gcloud auth application-default login`) or switch your auth type to standard.' | ||
| ); | ||
| } | ||
| if (googleApiKey || (googleCloudProject && googleCloudLocation)) { | ||
| contentGeneratorConfig.apiKey = googleApiKey; | ||
| contentGeneratorConfig.vertexai = true; | ||
|
|
||
| return contentGeneratorConfig; | ||
| return contentGeneratorConfig; | ||
| } | ||
| } |
There was a problem hiding this comment.
This proactive validation check introduces a false-positive error for users who want to authenticate with Vertex AI using ambient Google Cloud credentials (such as those configured via gcloud auth application-default login or available ambiently on GCP environments like Cloud Run, GKE, or GCE) but also happen to have a standard GEMINI_API_KEY set in their environment or keychain.
In these valid scenarios, googleCloudProject and googleCloudLocation environment variables might not be explicitly set, yet authentication would succeed via Application Default Credentials (ADC). This check will incorrectly block these users with a misleading error message.
To fix the underlying issue (where the SDK mistakenly falls back to GEMINI_API_KEY in Vertex AI mode and causes a cryptic 401 error), we should instead prevent the SDK from picking up GEMINI_API_KEY when using Vertex AI with ADC. This can be achieved by temporarily removing GEMINI_API_KEY from process.env during the GoogleGenAI client initialization in createContentGenerator (around line 391), rather than throwing a proactive error here.
If ADC is indeed missing, the Google Auth library will naturally throw a clear, standard, and actionable error: Could not load the default credentials....
if (authType === AuthType.USE_VERTEX_AI) {
if (googleApiKey || (googleCloudProject && googleCloudLocation)) {
contentGeneratorConfig.apiKey = googleApiKey;
contentGeneratorConfig.vertexai = true;
return contentGeneratorConfig;
}
}…ing instead of proactive validation
gemini-cli
Bot
added
priority/p2
|
Hi @joneba-google @DavidAPierce , just wanted to follow up on this PR and check if you’ve had a chance to review it. I’d be happy to make any changes or address any feedback needed. |
1 participant
This PR improves the error handling and developer experience when configuring authentication for Vertex AI.
Previously, if a user attempted to use the vertex-ai auth type but only provided a standard Gemini API key (without Google Cloud credentials), the CLI would attempt the request and fail with a cryptic 401 Unauthorized error from the Vertex endpoint.
This update adds proactive validation in createContentGeneratorConfig. It now checks if the user is in Vertex AI mode with only a standard key and throws a descriptive, actionable error message before the network request is ever made, guiding them to use Google Cloud credentials or switch their auth type.
Related Issue
Fixes #28622
What changed
Added validation logic in packages/core/src/core/contentGenerator.ts to catch the mismatched credential state.
Added a specific error message guiding the user to use gcloud auth application-default login or standard auth.
Added a corresponding unit test in packages/core/src/core/contentGenerator.test.ts to ensure this exact configuration rejects with the expected error.
Checklist
[x] I have read the contributing guidelines.
[x] I have run npm run build successfully.
[x] I have run npm test and all tests pass locally.
[x] I have added new unit tests to cover my changes.