Problem Description

When using Vertex AI with Application Default Credentials (ADC), OpenClaw returns 401 status code (no body) error. Direct API calls with curl using the same ADC credentials work correctly.

Environment

• OpenClaw version: 2026.4.2
• pi-ai version: 0.64.0
• @google/genai version: 1.47.0
• GCP Project: [REDACTED]
• Location: us-central1

Environment Variables

• GOOGLE_CLOUD_PROJECT=[REDACTED]
• GOOGLE_CLOUD_LOCATION=us-central1
• GOOGLE_APPLICATION_CREDENTIALS=/root/.config/gcloud/application_default_credentials.json
• GOOGLE_GENAI_USE_VERTEXAI=true

Reproduction Steps

1. Configure OpenClaw to use google-vertex provider with OAuth authentication
2. Ensure ADC credentials are properly set up (gcloud auth application-default login)
3. Attempt to make a request using any google-vertex model (e.g., google/gemini-2.5-flash)
4. Receive 401 error: 401 status code (no body)

Expected Behavior

OpenClaw should properly authenticate with Vertex AI using ADC OAuth and return valid responses, same as direct curl requests.

Direct Curl Test (Works)

TOKEN=$(gcloud auth application-default print-access-token)
curl -X POST -H Authorization: Bearer $TOKEN -H Content-Type: application/json -d {contents:[{parts:[{text:Hello}]}]} https://us-central1-aiplatform.googleapis.com/v1beta1/projects/[PROJECT]/locations/us-central1/publishers/google/models/gemini-2.5-flash:generateContent

Root Cause Analysis

Finding 1: pi-ai google-vertex.js imports wrong SDK module

The google-vertex.js provider in pi-ai imports from @google/genai which resolves to the web version, not the Node.js version. The SDK requires Node.js-specific imports for proper ADC authentication.

Finding 2: Google extension hooks into google-vertex requests

The bundled Google extension in OpenClaw core registers hookAliases: [google-antigravity, google-vertex]. This causes it to intercept ALL google-vertex requests. However, the Google extension auth handling is designed for API key authentication (createProviderApiKeyAuthMethod), NOT ADC OAuth.

Finding 3: Custom provider config conflicts

The custom google-vertex provider config has auth: oauth which triggers OpenClaw OAuth handling but returns marker string without properly exchanging it for a real bearer token.

What We Tried

1. Fixed pi-ai SDK imports - Changed from @google/genai to @google/genai/node
2. Removed custom provider config - Still returns 401
3. Changed auth setting - Still returns 401
4. Changed location - Still returns 401

Issue Summary

The core problem is that OpenClaw bundled Google extension has hookAliases: [google-vertex] which intercepts all google-vertex requests, but its auth handling is for API keys only - NOT ADC OAuth.

Request

Please fix the Google extension to properly support ADC OAuth for Vertex AI, OR provide a way to disable the hook alias for google-vertex so pi-ai implementation can work correctly.