Google Vertex AI

Call Gemini models in your own Google Cloud project through your Verdictan gateway. The gateway signs in to Google Cloud with an IAM identity, such as a service account, and your application calls the gateway with its application token in the Chat Completions format.

To use a Google AI Studio API key instead, see Google AI Studio (Gemini API).

Before you start

• A working gateway from the quickstart.
• A Google Cloud project ID, a region, and one publisher model ID that the project can use.
• A Google identity for the gateway with IAM permission to call the model. The example uses a service account key file.
• The gateway startup command, and a separate application token for test requests.

Configure the provider

Keep provider_type and format as shown. verdictan policy lint uses provider_type to require gcp_project. The target has no secret_key_ref, because the gateway gets a Google access token instead.

policy-config.yaml

pack:
  name: google-vertex-ai-integration
  version: 1.0.0
  enabled: true
policies:
  chain:
    - prompt-injection
providers:
  targets:
    - id: google-vertex-ai-primary
      provider: vertex-ai
      provider_type: google-vertex
      format: google-gemini
      model: "replace-with-vertex-model-id"
      base_url: https://aiplatform.googleapis.com
      gcp_project: "replace-with-gcp-project-id"
      gcp_region: us-central1

The gateway sends each request to /v1/projects/{gcp_project}/locations/{gcp_region}/publishers/google/models/{model}:generateContent. If you leave out gcp_region, it uses us-central1.

Credentials

The gateway uses the first of these that gives a token, and sends it as a Bearer token:

1. An oauth2 block on the target. See OAuth2 authentication.
2. A token from the target's secret_key_ref.
3. The GOOGLE_VERTEX_ACCESS_TOKEN environment variable.
4. The metadata server of a Google Cloud instance (Application Default Credentials).
5. The service account key file named by GOOGLE_APPLICATION_CREDENTIALS.

The gateway never runs gcloud. It only makes HTTP requests and reads files.

Start and verify

For deployment from a local file, use CLI 0.1.14 or later. Keep the Google identity available to the gateway. After In sync, send the non-streaming Vertex AI request below.

1. In the gateway terminal, point to a service account key file and lint the config. On a Google Cloud instance with an authorized attached identity, skip the export.

   export GOOGLE_APPLICATION_CREDENTIALS="/absolute/path/to/service-account.json"
   verdictan policy lint --file policy-config.yaml

   In a container, mount the key file read-only and use its path inside the container. See Manage configuration in a file.

2. Restart the test gateway in the same terminal, so that GOOGLE_APPLICATION_CREDENTIALS is in its environment.

3. Deploy the file to the test agent in Configurations. If that agent already runs pack.version 1.0.0, increase the version first. Then wait for the gateway log line connected read model refresh applied updated config with your version as config_version. Try the change on a test gateway has the steps.

4. In a second terminal, send a non-streaming request for the configured model:

   export VERDICTAN_CLIENT_TOKEN="<application-token>"
   curl --fail-with-body http://127.0.0.1:41002/v1/chat/completions \
     -H "Authorization: Bearer ${VERDICTAN_CLIENT_TOKEN}" \
     -H "Content-Type: application/json" \
     -d '{"model":"replace-with-vertex-model-id","stream":false,"messages":[{"role":"user","content":"Reply with one short sentence."}]}'

A choices array in the response proves the whole path: application token, Google credential, IAM permission, and endpoint. /healthz and policy lint do not contact Google Cloud. If the request fails, see Failure behavior.

Supported requests

Request	Support
Chat Completions, text, stream: false	Yes. Messages and common generation settings go to Gemini generateContent, and the first candidate comes back as choices.
Streaming	Not recommended. Not every stream frame is translated.
Messages	Not tested with this adapter
Tools, image input, Responses, embeddings, response_format	No

Failure behavior

What happens	Cause
policy lint stops and names a missing key	model or base_url is empty.
The config is rejected	base_url does not start with https://.
policy lint reports a missing gcp_project	Set gcp_project. Without it, requests go to an endpoint with an empty project segment.
The gateway starts, but each request fails with google-vertex requires credentials	No credential source gave a token.
The request fails with a service account error	GOOGLE_APPLICATION_CREDENTIALS names a file the gateway cannot read or parse.
The target is not selected	The request model does not match the target model.
The client gets a 4xx or 5xx from Vertex AI	The gateway passes the upstream status through. Check IAM, the region, and the model.
502 with upstream_error	The gateway cannot connect to Vertex AI.

Limits

• Model names, regions, prices, quotas, and data terms are in the Vertex AI documentation.
• The key file format and the metadata server are described in Application Default Credentials.
• A listener on a non-loopback address needs TLS and network controls.

Next steps

• Google AI Studio (Gemini API): Gemini with an API key.
• Provider Configuration: OAuth2 and other target fields.
• Troubleshooting: failed gateway starts and requests.