BerriAI/litellm · error · ValueError

Could not resolve credentials - either dynamically or from e

Error message

Could not resolve credentials - either dynamically or from environment, for project_id: {project_id}

What it means

Raised in `get_access_token` when `self.load_auth(...)` completed without raising but returned None credentials for the requested project. `load_auth` resolves credentials from the explicit `vertex_credentials` param, `litellm.vertex_credentials`, VERTEXAI_CREDENTIALS, or Google Application Default Credentials; a None result means none of these sources yielded a usable credentials object. The preceding verbose log "Failed to load vertex credentials..." usually carries the underlying reason.

Source

Thrown at litellm/llms/vertex_ai/vertex_llm_base.py:910

                credential_project_id,
            )

        else:
            verbose_logger.debug(
                "Credential cache key not found for project_id: %s, loading new credentials", project_id
            )

            try:
                _credentials, credential_project_id = self.load_auth(credentials=credentials, project_id=project_id)
            except Exception as e:
                verbose_logger.exception(
                    "Failed to load vertex credentials. Check to see if credentials containing partial/invalid information. Error: %s",
                    e,
                )
                raise e

            if _credentials is None:
                raise ValueError(
                    f"Could not resolve credentials - either dynamically or from environment, for project_id: {project_id}"
                )
            # Cache the project_id and credentials from load_auth result (resolved project_id)
            self._credentials_project_mapping[credential_cache_key] = (
                _credentials,
                credential_project_id,
            )

        ## VALIDATE CREDENTIALS
        verbose_logger.debug("Validating credentials")
        if project_id is None and credential_project_id is not None and isinstance(credential_project_id, str):
            project_id = credential_project_id
            # Update cache with resolved project_id for future lookups
            resolved_cache_key: Final = (cache_credentials, project_id)
            if resolved_cache_key not in self._credentials_project_mapping:
                self._credentials_project_mapping[resolved_cache_key] = (
                    _credentials,
                    credential_project_id,

View on GitHub (pinned to 77b7c6c40c)

Solutions

Authenticate via ADC: gcloud auth application-default login (local dev) or attach a GCP service account (workload identity / instance metadata) in production.
Or provide a service-account key explicitly: set VERTEXAI_CREDENTIALS to the full JSON contents, or pass vertex_credentials=<json string> / set GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json.
Check the verbose log line just before this error (enable litellm.set_verbose=True or debug logging) — it prints the exception from load_auth that explains why each source failed.
Confirm the environment actually reaches metadata server or has the key file readable by the process user.

Example fix

# before
import litellm
litellm.completion(model="vertex_ai/gemini-1.5-pro", messages=[...])
# -> ValueError: Could not resolve credentials ... for project_id: None

# after
import litellm
litellm.completion(
    model="vertex_ai/gemini-1.5-pro",
    messages=[...],
    vertex_credentials=open("/path/sa.json").read(),
    vertex_project="my-gcp-project",
)

Defensive patterns

Strategy: validation

Validate before calling

import os

def vertex_creds_configured() -> bool:
    return any([
        os.getenv("VERTEXAI_CREDENTIALS"),
        os.getenv("GOOGLE_APPLICATION_CREDENTIALS"),
        bool(getattr(litellm, "vertex_credentials", None)),
    ]) or adc_metadata_available()  # e.g. probe http://metadata.google.internal on GCP

Try / catch

try:
        litellm.completion(model="vertex_ai/gemini-1.5-pro", messages=msgs)
except ValueError as e:
    if "Could not resolve credentials" in str(e):
        raise ConfigError("No GCP credentials found — run gcloud auth application-default login or set VERTEXAI_CREDENTIALS") from e
    raise

Prevention

Add a startup preflight: verify one credential source (ADC login, env key, or workload identity) exists before serving.
In CI/containers, mount the SA key and export GOOGLE_APPLICATION_CREDENTIALS explicitly.
Enable litellm verbose logging during integration so load_auth's underlying exception is visible.

When it happens

Trigger: Calling Vertex AI models with no GOOGLE_APPLICATION_CREDENTIALS, no `gcloud auth application-default login`, no VERTEXAI_CREDENTIALS env var, and no `vertex_credentials` param on a machine where ADC discovery finds nothing; also when credentials are present but the metadata-server path is unavailable (e.g. non-GCP CI runner).

Common situations: Fresh dev machines or CI containers that never ran gcloud login; deploying to Kubernetes/EKS where neither the workload identity nor the key file was mounted; assuming Vertex works with only a Gemini API key set.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/b470dd3afa04d533. Report an issue: GitHub.