Bug Description

OpenClaw's google-vertex provider consistently fails with 401 CREDENTIALS_MISSING authentication errors when the gateway service runs through proxychains.

Key findings:

1. ✅ Service Account credentials are valid and work directly
2. ✅ gcloud ADC authentication succeeds without proxy
3. ✅ Vertex AI API is accessible when proxychains is removed
4. ❌ But OpenClaw's google-vertex provider fails with proxychains

The error occurs because @google/genai library's internal authentication flow appears to be disrupted by proxychains' LD_PRELOAD interception.

Environment

• OpenClaw Version: 2026.3.13
• Node.js: v22.22.0
• OS: Linux 5.15.0-117-generic (x64)
• Proxy: proxychains 4.x with localnet bypass configured
• Google Cloud: Service Account authentication via gcloud ADC
• Model: google-vertex/gemini-2.5-pro

Steps to Reproduce

1. Configure OpenClaw gateway to run through proxychains (common for users behind corporate/firewall proxies):

   ExecStart=/usr/bin/proxychains -q /usr/bin/node /path/to/openclaw/dist/index.js gateway --port 18789

2. Set up Google Vertex AI authentication:

   export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
   export GOOGLE_CLOUD_PROJECT=your-project
   export GOOGLE_CLOUD_LOCATION=us-central1

3. Configure OpenClaw to use Vertex AI:

   openclaw models set google-vertex/gemini-2.5-pro

4. Observe authentication failures in logs:

   401 UNAUTHENTICATED: "API keys are not supported by this API. Expected OAuth2 access token or other authentication credentials..."
   CREDENTIALS_MISSING
   

Expected Behavior

Vertex AI authentication should work through proxychains, or at least fail gracefully with a clear error message about proxy interference.

Actual Behavior

Consistent 401 CREDENTIALS_MISSING errors that trigger unnecessary API call cascades:

• Each user request triggers 3-5 failed API attempts
• Response delays of 10-60 seconds
• Unnecessary consumption of API quotas

Root Cause Analysis

Based on debugging:

1. Direct API tests succeed - Vertex AI API is accessible with Service Account
2. gcloud ADC works - gcloud auth application-default print-access-token returns valid tokens
3. OpenClaw code appears correct - resolveApiKey function properly handles empty API keys
4. Problem isolated to proxychains - When proxychains is removed from service configuration, authentication works immediately

The issue seems to be that @google/genai library's internal token acquisition process (which calls Google Cloud SDK) is disrupted by proxychains' system call interception.

Workaround

Temporarily remove proxychains from the OpenClaw service configuration:

# Before (fails):
ExecStart=/usr/bin/proxychains -q /usr/bin/node ...

# After (works):
ExecStart=/usr/bin/node ...

But this isn't ideal for users who require proxy support for network access.

Suggested Solutions

Option 1: Make google-vertex provider proxy-aware

• Detect proxy environment variables
• Configure @google/genai library with proxy settings
• Or use alternative authentication methods that work with proxies

Option 2: Document the limitation

• Clearly document that proxychains interferes with Google Cloud SDK authentication
• Provide alternative proxy configuration methods

Option 3: Provide proxy configuration guidance

• Guide users on configuring proxychains to allow Google API domains
• Suggest alternative proxy tools that work better with Google Cloud SDK

Option 4: Implement fallback mechanism

• Detect authentication failures due to proxy
• Provide clear error messages suggesting proxy-related fixes
• Automatically retry without proxy if safe

Additional Context

This affects users in corporate environments or regions where proxy usage is mandatory for external network access. The workaround of removing proxychains may not be feasible for all users.

Related Code

The issue appears in OpenClaw's google-vertex provider implementation, specifically in how it interacts with @google/genai library for authentication.