Bug type

Behaviour bug

Summary

google-vertex plugin manifest declares authEvidence for ADC (env-based credentials with credentialMarker: gcp-vertex-credentials). On 2026.5.7, with all required env vars present, openclaw models list reports the provider as configured, but no profile is written to the agent's auth-profiles.json, and runtime requests fail with No API key found for provider "google-vertex".

The fix tracked in #47304 (closing #56253) is verified present in my install at both layers:

• OpenClaw's marker producer code (model-auth-env-*.js, model-auth-markers-*.js) contains GCP_VERTEX_CREDENTIALS_MARKER
• Bundled pi-ai 0.73.0 contains the marker filter in resolveApiKey()

But the marker never makes it into a profile, so the runtime resolver's profile lookup returns null before either layer is consulted at request time.

Environment

• OpenClaw: 2026.5.7 (npm global install, latest dist-tag)
• OS: Ubuntu 24
• Service: systemd --user service (openclaw-gateway.service)
• Auth method: service account JSON via GOOGLE_APPLICATION_CREDENTIALS
• GCP project: Vertex AI API enabled, SA has roles/aiplatform.user

Reproduction

1. Set in gateway env (verified in process via /proc/$PID/environ):

   GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json
   GOOGLE_CLOUD_PROJECT=<project>
   GOOGLE_CLOUD_LOCATION=global
   

2. Start gateway, send a prompt to google-vertex/gemini-2.5-pro.
3. Observe error:

   FailoverError: No API key found for provider "google-vertex".
   Auth store: ~/.openclaw/agents/main/agent/auth-profiles.json
   (agentDir: ~/.openclaw/agents/main/agent).
   Configure auth for this agent (openclaw agents add <id>) or copy only portable
   static auth profiles from the main agentDir.
   

Diagnostic evidence

Plugin loaded with provider registered:

$ openclaw plugins list --json | jq '.plugins[] | select(.id=="google") | {enabled, status, providerIds}'
{
  "enabled": true,
  "status": "loaded",
  "providerIds": ["google", "google-gemini-cli", "google-vertex"]
}

Plugin manifest declares the auth evidence:

$ grep -n "google-vertex\|gcp-vertex-credentials\|authEvidence\|requiresAllEnv\|fileEnvVar\|credentialMarker" \
  ~/.npm-global/lib/node_modules/openclaw/dist/extensions/google/openclaw.plugin.json
10:    "google-vertex"
27:      "google-vertex": {
59:      "endpointClass": "google-vertex",
66:      "endpointClass": "google-vertex",
81:      "google-vertex": {
89:        "id": "google-vertex",
96:        "authEvidence": [
99:            "fileEnvVar": "GOOGLE_APPLICATION_CREDENTIALS",
108:            "requiresAllEnv": [
111:            "credentialMarker": "gcp-vertex-credentials",

models list reports the provider as configured:

$ openclaw models list | grep vertex
google-vertex/gemini-3.1-pro-preview-cu... text   195k   no   no   configured
google-vertex/gemini-2.5-pro               text   195k   no   no   configured
google-vertex/gemini-3.1-flash-lite-pre... text   195k   no   no   configured

But no profile exists:

$ openclaw models auth list --provider google-vertex
Agent: main
Auth state file: ~/.openclaw/agents/main/agent/auth-state.json
Provider: google-vertex
Profiles: (none)

And the CLI doesn't accept auth login for this provider (consistent with the design intent that env-based auth shouldn't require interactive login):

$ openclaw models auth login --provider google-vertex
Error: Unknown provider "google-vertex". Loaded providers: google, google-gemini-cli.

Direct REST call with the same SA JSON succeeds, ruling out credential, project, or model issues:

gcloud auth activate-service-account --key-file=/path/to/sa.json
TOKEN=$(gcloud auth print-access-token)
curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  "https://aiplatform.googleapis.com/v1/projects/<project>/locations/global/publishers/google/models/gemini-2.5-pro:generateContent" \
  -d '{"contents":[{"role":"user","parts":[{"text":"hello"}]}]}'
# 200 OK

google/gemini-2.5-pro (AI Studio path, same project, side-by-side env) works fine — confirming the issue is specific to the google-vertex runtime auth path.

Expected behaviour

Either:

1. The env-evidence path (fileEnvVar + requiresAllEnv satisfied) writes a google-vertex profile entry with apiKey: "gcp-vertex-credentials" automatically when models list first detects the provider as configured, OR
2. The runtime auth resolver consults authEvidence directly when no profile is present, bypassing the profile-required path

Either way, an env-only ADC setup that passes the models list configured check should also pass the runtime auth check. Currently the two checks disagree.

Cross-references

• [Bug]: #47304 — umbrella ADC fix tracked here (closed 2026-04-25 as implemented)
• [Bug]: google-vertex provider ignores ADC credentials — throws 'No API key found' #56253 — closed as duplicate of [Bug]: #47304
• bug: google-vertex plugin not found / stale config entry not resolved on plugin load #54104 — google-vertex plugin loading issues (different cause; in my case the plugin loads correctly)
• [Bug]: google-vertex OAuth/service-account auth works on 2026.4.9, fails on 2026.4.10 with 401 CREDENTIALS_MISSING #64852 — prior regression on related code path (2026.4.9 → 2026.4.10)
• [Bug]: gateway install --force drops GOOGLE_APPLICATION_CREDENTIALS from generated gateway.systemd.env #79578 — adjacent install-time bug filed by me: gateway install --force drops GOOGLE_APPLICATION_CREDENTIALS from generated gateway.systemd.env. Not the cause of this issue (env confirmed in process before testing) but a related foot-gun on the way here.

Workaround

None found. Setting GOOGLE_VERTEX_BASE_URL (per #11413) has no effect. Synthetic auth-profiles.json entries didn't fire. Reverted to AI Studio (google/gemini-2.5-pro) for now, which works fine on the same project with the same env.

Willing to help

Happy to provide additional debug output, run targeted diagnostics, or test patches.