Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

When openclaw doctor (or openclaw gateway install --force) regenerates the systemd service file, it does not include GOOGLE_APPLICATION_CREDENTIALS in the Environment= entries, even if this variable is defined in the env block of openclaw.json.

As a result, the gateway process cannot authenticate with the google-vertex provider via Application Default Credentials (ADC), and all agent calls fail immediately after the service is reinstalled.

Steps to reproduce

1. Configure openclaw.json with env.GOOGLE_APPLICATION_CREDENTIALS pointing to a GCP service account JSON file
2. Set agents.defaults.model to google-vertex/gemini-3-flash-preview (or similar)
3. Run openclaw doctor and accept the prompt to update gateway service config
4. Restart the gateway via systemd
5. Observe all agent requests fail with auth error

Expected behavior

All variables in openclaw.json's env block (or at least GOOGLE_APPLICATION_CREDENTIALS) should be forwarded to the systemd service Environment= entries, consistent with how GOOGLE_CLOUD_PROJECT and GOOGLE_CLOUD_LOCATION are already included.

Actual behavior

Error in journalctl --user -u openclaw-gateway:

Error: No API key found for provider "google-vertex".
Auth store: /home/openclaw/.openclaw/agents/main/agent/auth-profiles.json

The generated ~/.config/systemd/user/openclaw-gateway.service includes:

Environment=GOOGLE_CLOUD_PROJECT=myproject
Environment=GOOGLE_CLOUD_LOCATION=global

But is missing:

Environment=GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json

Workaround

Option A — Add to ~/.openclaw/.env (survives gateway install --force):

echo 'GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json' >> ~/.openclaw/.env

Option B — Manually add to the systemd service file, then daemon-reload:

Environment=GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json

systemctl --user daemon-reload && systemctl --user restart openclaw-gateway

OpenClaw version

2026.4.8

Operating system

Ubuntu 24.04 (x64) — VPS / systemd user service

Install method

npm global

Model

google-vertex/gemini-3-flash-preview

Provider / routing chain

openclaw → google-vertex (Vertex AI via ADC / service account JSON)

Logs, screenshots, and evidence

Apr 10 11:33:33 node: Error: No API key found for provider "google-vertex".
  Auth store: /home/openclaw/.openclaw/agents/main/agent/auth-profiles.json (agentDir: ...)
Apr 10 11:33:33 node: [model-fallback] decision=candidate_failed reason=auth next=none
Apr 10 11:33:33 node: Embedded agent failed before reply: No API key found for provider "google-vertex".

Additional information

Related: #61847 (same class of issue — gateway install --force drops user-added Environment= entries; AWS case)

The env block in openclaw.json already forwards GOOGLE_CLOUD_PROJECT and GOOGLE_CLOUD_LOCATION to the systemd unit. GOOGLE_APPLICATION_CREDENTIALS should be treated consistently.