{"record":{"id":"b470dd3afa04d533","repo":"BerriAI/litellm","slug":"could-not-resolve-credentials-either-dynamically","errorCode":null,"errorMessage":"Could not resolve credentials - either dynamically or from environment, for project_id: {project_id}","messagePattern":"Could not resolve credentials - either dynamically or from environment, for project_id: (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/llms/vertex_ai/vertex_llm_base.py","lineNumber":910,"sourceCode":"                credential_project_id,\n            )\n\n        else:\n            verbose_logger.debug(\n                \"Credential cache key not found for project_id: %s, loading new credentials\", project_id\n            )\n\n            try:\n                _credentials, credential_project_id = self.load_auth(credentials=credentials, project_id=project_id)\n            except Exception as e:\n                verbose_logger.exception(\n                    \"Failed to load vertex credentials. Check to see if credentials containing partial/invalid information. Error: %s\",\n                    e,\n                )\n                raise e\n\n            if _credentials is None:\n                raise ValueError(\n                    f\"Could not resolve credentials - either dynamically or from environment, for project_id: {project_id}\"\n                )\n            # Cache the project_id and credentials from load_auth result (resolved project_id)\n            self._credentials_project_mapping[credential_cache_key] = (\n                _credentials,\n                credential_project_id,\n            )\n\n        ## VALIDATE CREDENTIALS\n        verbose_logger.debug(\"Validating credentials\")\n        if project_id is None and credential_project_id is not None and isinstance(credential_project_id, str):\n            project_id = credential_project_id\n            # Update cache with resolved project_id for future lookups\n            resolved_cache_key: Final = (cache_credentials, project_id)\n            if resolved_cache_key not in self._credentials_project_mapping:\n                self._credentials_project_mapping[resolved_cache_key] = (\n                    _credentials,\n                    credential_project_id,","sourceCodeStart":892,"sourceCodeEnd":928,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/llms/vertex_ai/vertex_llm_base.py#L892-L928","documentation":"Raised in `get_access_token` when `self.load_auth(...)` completed without raising but returned None credentials for the requested project. `load_auth` resolves credentials from the explicit `vertex_credentials` param, `litellm.vertex_credentials`, VERTEXAI_CREDENTIALS, or Google Application Default Credentials; a None result means none of these sources yielded a usable credentials object. The preceding verbose log \"Failed to load vertex credentials...\" usually carries the underlying reason.","triggerScenarios":"Calling Vertex AI models with no GOOGLE_APPLICATION_CREDENTIALS, no `gcloud auth application-default login`, no VERTEXAI_CREDENTIALS env var, and no `vertex_credentials` param on a machine where ADC discovery finds nothing; also when credentials are present but the metadata-server path is unavailable (e.g. non-GCP CI runner).","commonSituations":"Fresh dev machines or CI containers that never ran gcloud login; deploying to Kubernetes/EKS where neither the workload identity nor the key file was mounted; assuming Vertex works with only a Gemini API key set.","solutions":["Authenticate via ADC: gcloud auth application-default login (local dev) or attach a GCP service account (workload identity / instance metadata) in production.","Or provide a service-account key explicitly: set VERTEXAI_CREDENTIALS to the full JSON contents, or pass vertex_credentials=<json string> / set GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json.","Check the verbose log line just before this error (enable litellm.set_verbose=True or debug logging) — it prints the exception from load_auth that explains why each source failed.","Confirm the environment actually reaches metadata server or has the key file readable by the process user."],"exampleFix":"# before\nimport litellm\nlitellm.completion(model=\"vertex_ai/gemini-1.5-pro\", messages=[...])\n# -> ValueError: Could not resolve credentials ... for project_id: None\n\n# after\nimport litellm\nlitellm.completion(\n    model=\"vertex_ai/gemini-1.5-pro\",\n    messages=[...],\n    vertex_credentials=open(\"/path/sa.json\").read(),\n    vertex_project=\"my-gcp-project\",\n)","handlingStrategy":"validation","validationCode":"import os\n\ndef vertex_creds_configured() -> bool:\n    return any([\n        os.getenv(\"VERTEXAI_CREDENTIALS\"),\n        os.getenv(\"GOOGLE_APPLICATION_CREDENTIALS\"),\n        bool(getattr(litellm, \"vertex_credentials\", None)),\n    ]) or adc_metadata_available()  # e.g. probe http://metadata.google.internal on GCP","typeGuard":null,"tryCatchPattern":"try:\n        litellm.completion(model=\"vertex_ai/gemini-1.5-pro\", messages=msgs)\nexcept ValueError as e:\n    if \"Could not resolve credentials\" in str(e):\n        raise ConfigError(\"No GCP credentials found — run gcloud auth application-default login or set VERTEXAI_CREDENTIALS\") from e\n    raise","preventionTips":["Add a startup preflight: verify one credential source (ADC login, env key, or workload identity) exists before serving.","In CI/containers, mount the SA key and export GOOGLE_APPLICATION_CREDENTIALS explicitly.","Enable litellm verbose logging during integration so load_auth's underlying exception is visible."],"tags":["vertex-ai","credentials","application-default-credentials","authentication"],"backgroundTag":"gcp-credentials-not-found","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}