VertexAI: Add service account key authentication support by multiplegeorges · Pull Request #532 · crmne/ruby_llm

multiplegeorges · 2025-12-09T20:22:30Z

What this does

This pull request adds support for authenticating to Google Vertex AI using a Service Account JSON key in addition to the existing Application Default Credentials (ADC) method. It updates both the documentation and the implementation to allow users to provide a Service Account key for Vertex AI authentication, improving flexibility and compatibility with Google Cloud best practices.

Vertex AI Authentication Enhancements:

Added a new configuration option vertexai_service_account_key to the RubyLLM configuration, allowing users to specify a Service Account JSON key as a string for Vertex AI authentication. [1] [2] [3]
Updated the Vertex AI provider logic to use the Service Account key for authentication if provided; otherwise, it falls back to Application Default Credentials (ADC). This includes refactoring the authorizer initialization to support both methods and defining the required OAuth scopes. [1] [2]

Documentation Updates:

Expanded the configuration documentation to explain the new vertexai_service_account_key option, how authentication works, and Google Cloud’s recommendations regarding API keys and Service Accounts.

Test/Spec Configuration:

Updated the test configuration to include a default value for vertexai_service_account_key, ensuring test environments can utilize the new authentication method.

Type of change

Scope check

I read the Contributing Guide
This aligns with RubyLLM's focus on LLM communication
This isn't application-specific logic that belongs in user code
This benefits most users, not just my specific use case

Quality check

[x ] I ran overcommit --install and all hooks pass
I tested my changes thoroughly
- For provider changes: Re-recorded VCR cassettes with bundle exec rake vcr:record[provider_name]
- All tests pass: bundle exec rspec
I updated documentation if needed
I didn't modify auto-generated files manually (models.json, aliases.json)

API changes

Breaking change
New public methods/classes
Changed method signatures
No API changes

Related issues

None.

…ation logic - Added `vertexai_service_account_key` to the configuration requirements for Vertex AI. - Updated the authorization method to use service account credentials if the key is provided, otherwise defaults to application default credentials.

multiplegeorges · 2025-12-09T20:30:34Z

Looks like #520 is making related changes to the Vertex provider, so probably a good idea to review both in tandem/together.

crespire · 2025-12-10T14:52:39Z

+1, could use this!

Kcharle · 2025-12-10T15:15:58Z

+1

NielsKSchjoedt · 2026-01-03T16:07:51Z

in the mean time something like this can be done:

  credentials = Rails.application.credentials.dig(:google_cloud, :credentials)

  if credentials.present?
    # Write credentials to temp file for Google Cloud SDK authentication
    require "tempfile"
    require "json"

    credentials_file = Tempfile.new([ "vertex_ai_credentials", ".json" ])
    credentials_file.write(credentials.to_json)
    credentials_file.close

    # Set environment variable for Google Cloud SDK
    ENV["GOOGLE_APPLICATION_CREDENTIALS"] = credentials_file.path

    # Clean up temp file on exit
    at_exit { credentials_file.unlink }

    # Configure Vertex AI
    config.vertexai_project_id = Rails.application.credentials.dig(:google_cloud, :project_id)
    config.vertexai_location = Rails.application.credentials.dig(:google_cloud, :location)
  end

We initially named this configuration `_hash` but was later updated to `_key`

…ion-key Change service account hash to key for authorizer

crespire · 2026-02-18T14:25:35Z

@crmne would love to get this merged in, as we currently have to maintain a fork to auth this way.

jordan-brough · 2026-02-20T23:23:59Z

We're using the same type of workaround and would love to see this merged in to avoid forking / monkey patching / tempfile wrangling.

crmne · 2026-03-02T22:13:09Z

+      config.vertexai_project_id = ENV.fetch('GOOGLE_CLOUD_PROJECT', 'test-project')
+      config.vertexai_location = ENV.fetch('GOOGLE_CLOUD_LOCATION', 'us-central1')
+      config.vertexai_service_account_key = ENV.fetch('VERTEXAI_SERVICE_ACCOUNT_KEY', "{ secret_key: 'test' }")


You're redefining 2 properties and moving the whole block of vertex ai configs up breaking the sorting.

crmne · 2026-03-02T22:13:48Z

-        @authorizer = ::Google::Auth.get_application_default(
-          scope: [
-            'https://www.googleapis.com/auth/cloud-platform',
-            'https://www.googleapis.com/auth/generative-language.retriever'
-          ]
-        )
+        @authorizer = if @config.vertexai_service_account_key
+          ::Google::Auth::ServiceAccountCredentials.make_creds(
+            json_key_io: StringIO.new(@config.vertexai_service_account_key),
+            scope: SCOPES
+          )
+        else
+          ::Google::Auth.get_application_default(scope: SCOPES)
+        end


This reintroduces the bug fixed by #520

crmne · 2026-03-02T22:14:22Z

      class << self
        def configuration_requirements
-          %i[vertexai_project_id vertexai_location]
+          %i[vertexai_project_id vertexai_location vertexai_service_account_key]


This breaks ADC only configs by making the service account key a hard requirement and contradicts the intended fallback behaviour of ADC or service account.

crmne · 2026-03-02T22:16:40Z

  config.gemini_api_key = ENV['GEMINI_API_KEY']
  config.vertexai_project_id = ENV['GOOGLE_CLOUD_PROJECT'] # Available in v1.7.0+
  config.vertexai_location = ENV['GOOGLE_CLOUD_LOCATION']
+  config.vertexai_service_account_key = ENV['VERTEXAI_SERVICE_ACCOUNT_KEY'] # JSON Key as String from GCP


This should be framed as optional when ADC is in place.

crmne · 2026-03-02T22:17:29Z

+Google Cloud disallows the creation of Vertex AI API keys for Service Accounts, by default. The recommended way to connect is by using a Service Account's JSON key with appropriate IAM roles or by using Application Default Credentials.
+
+RubyLLM supports both methods of authenticating to Vertex AI and will only use a Service Account key if the key is provided in the `config.vertexai_service_account_key` configuration field. Otherwise, it will fallback to ADC.
+


This frames ADC as a second class choice. Please rephrase to portray both options as equally valid and supported.

crmne · 2026-03-02T22:27:40Z

Thanks for the contribution. I opened a replacement PR from our repo branch with the requested fixes because this PR’s source branch currently has maintainer edits disabled.

Could you please enable “Allow edits by maintainers” on future cross-repo PRs? That lets us apply review fixes directly and reduces round-trips.

## Summary This replaces #532 with the same feature intent (Vertex AI service account support) while keeping ADC as the default path and avoiding regressions. ### What changed - Keep `vertexai_service_account_key` optional (do **not** require it in provider configuration requirements). - Preserve ADC flow when no service account key is set. - Restore `Google::Auth.get_application_default` call to pass scopes positionally (compat with current `googleauth` behavior). - Clean up Vertex settings in `spec/support/rubyllm_configuration.rb`: - remove duplicate `vertexai_project_id` / `vertexai_location` assignments - avoid forcing an invalid default service-account key in test config - Update docs wording to clearly state: - ADC and service-account key are both supported - service-account key is optional - ADC is used when service-account key is unset - fix typo in configuration reference ## Why replacement PR #532 is from a fork with maintainer edits disabled, so we cannot push fixes directly to that branch. ## Related - Supersedes: #532 - Includes compatibility intent from: #520 --------- Co-authored-by: Georges Gabereau <georges.gabereau@gmail.com> Co-authored-by: Simmon Li <hello@crespire.dev>

crespire · 2026-03-04T18:25:13Z

Thanks for addressing the issue either way, appreciate it!

multiplegeorges · 2026-03-04T18:38:05Z

Thanks for the review and merging it @crmne. Really appreciate it and I'll remember to update "Allow edits by maintainers" next time!

multiplegeorges added 3 commits December 9, 2025 12:16

Add documentation

f936e73

Remove trailing whitespace, add new param to spec configuration

5fbe54d

crespire and others added 3 commits January 5, 2026 16:30

Change service account hash to key for authorizer

e249746

We initially named this configuration `_hash` but was later updated to `_key`

Merge pull request #1 from crespire/crespire/hotfix-update-configurat…

c06b4bc

…ion-key Change service account hash to key for authorizer

Merge branch 'main' into add-vertex-service-account-support

e0a321f

crmne requested changes Mar 2, 2026

View reviewed changes

crmne mentioned this pull request Mar 2, 2026

VertexAI: service account key support without ADC regressions #646

Merged

crmne closed this Mar 2, 2026

		Google Cloud disallows the creation of Vertex AI API keys for Service Accounts, by default. The recommended way to connect is by using a Service Account's JSON key with appropriate IAM roles or by using Application Default Credentials.

		RubyLLM supports both methods of authenticating to Vertex AI and will only use a Service Account key if the key is provided in the `config.vertexai_service_account_key` configuration field. Otherwise, it will fallback to ADC.

Uh oh!

Conversation

multiplegeorges commented Dec 9, 2025

What this does

Type of change

Scope check

Quality check

API changes

Related issues

Uh oh!

multiplegeorges commented Dec 9, 2025

Uh oh!

crespire commented Dec 10, 2025

Uh oh!

Kcharle commented Dec 10, 2025

Uh oh!

NielsKSchjoedt commented Jan 3, 2026

Uh oh!

crespire commented Feb 18, 2026

Uh oh!

jordan-brough commented Feb 20, 2026

Uh oh!

crmne Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

crmne Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

crmne Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

crmne Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

crmne Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

crmne commented Mar 2, 2026

Uh oh!

crespire commented Mar 4, 2026

Uh oh!

multiplegeorges commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants