Support for Service Account (from Google Vertex AI) to access Gemini services

[sree1658]

Hi Hadley,

We attempted using ellmer library functions to access Gemini API services with service account json key file. We also found another library (gemini.R maintained by Jinhwan Kim) https://github.com/jhk0530/gemini.R which has support for Vertex platform from Google

Given a Service account Key from Google vertex ai platform,

{
  "type": "service_account",
  "project_id": "my-project-id",
  "private_key_id": "someprivatekeyid",
  "private_key": "...PRIVATE_KEY...",
  "client_email": "my-service-account@my-project-id.iam.gserviceaccount.com",
  "client_id": "my-client-id.apps.googleusercontent.com",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/my-service-account my-project-id.iam.gserviceaccount.com"
}

Could you please enable support for Service account (from google vertex ai platform) in ellmer library

Thanks
Sreeram R

[hadley]

@atheriel do you want to have a go at this one?

[atheriel]

I think we might want to teach ellmer about gargle, rather than reimplementing all of the Google auth paths. Similar to what we did with paws. I'm happy to try and hook this up this week, yes.

[atheriel]

@sree1658 Can you try out #320 to see if it works for you? You can install that PR locally with

pak::pkg_install("tidyverse/ellmer#320")

[sree1658]

@atheriel , We tried uninstalling existing ellmer library and re-installed ellmer using pak::pkg_install("tidyverse/ellmer#320"). Not sure on how to authenticate using service account json file. Could you please help

Here is the code

# remove.packages("ellmer")
library(gargle)
# pak::pkg_install("tidyverse/ellmer#320")
library(ellmer)

?credentials_service_account
token<-credentials_service_account(scopes = "https://www.googleapis.com/auth/cloud-platform",
                                   path = "C:\\Users\\analyticadmin\\Downloads\\cifcl-analytics-8516e988ce90.json"
                                   
url = "https://us-central1-aiplatform.googleapis.com/v1/projects/cifcl-analytics/locations/us-central1/publishers/google/models/gemini-2.0-flash:generateContent"
ellmer::Provider(base_url = url,extra_args = list(model = "gemini-2.0-flash",credentials = token))

Output:
 >ellmer::Provider(base_url = url,extra_args = list(model = "gemini-2.0-flash",credentials = token))

<ellmer::Provider>
 @ base_url  : chr "https://us-central1-aiplatform.googleapis.com/v1/projects/cifcl-analytics/locations/us-central1/publishers/goog"| __truncated__
 @ extra_args:List of 2
 .. $ model      : chr "gemini-2.0-flash"
 .. $ credentials:Classes 'TokenServiceAccount', 'Token2.0', 'Token', 'R6' <TokenServiceAccount>
  Inherits from: <Token2.0>
  Public:
    app: NULL
    cache: function (path) 
    cache_path: FALSE
    can_refresh: function () 
    clone: function (deep = FALSE) 
    credentials: list
    endpoint: oauth_endpoint
    hash: function () 
    init_credentials: function () 
    initialize: function (endpoint, secrets, params) 
    load_from_cache: function () 
    params: list
    print: function (...) 
    private_key: NULL
    refresh: function () 
    revoke: function () 
    secrets: list
    sign: function (method, url) 
    validate: function () 

[atheriel]

@sree1658 I think you need to use the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to your JSON file.

Google's own docs are useful: https://cloud.google.com/docs/authentication/application-default-credentials

[atheriel]

I think this should look something like this, though you may also need to set the base_url, too:

Sys.setenv(
  GOOGLE_APPLICATION_CREDENTIALS = "C:\\Users\\analyticadmin\\Downloads\\cifcl-analytics-8516e988ce90.json"
)

chat <- chat_gemini()

[hadley]

We should also document that the base_url looks like this: https://LOCATION-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/publishers/google/. i.e. don't include the models directory in the base url.

[sree1658]

@hadley @atheriel Its working now - Thanks for your support..

[arunrajes]

@atheriel @hadley ,

The above solution is not working for us. Could you please help

Thanks
Arun