continuedev/continue · error

Failed to load credentials for Vertex AI: ${e.message}

Error message

Failed to load credentials for Vertex AI: ${e.message}

What it means

VertexAI setupAuthentication, when a service account keyFile is configured, wraps GoogleAuth.getClient() and catches failures. On error it only logs this warning — clientPromise then resolves to undefined instead of rejecting, so the failure surfaces later as an opaque undefined-client error when a request is attempted.

Source

Thrown at packages/openai-adapters/src/apis/VertexAI.ts:126

          jsonClient.scopes = [VertexAIApi.AUTH_SCOPES];
        } else {
          throw new Error("VertexAI: keyJson must be a valid JWT");
        }
        this.clientPromise = Promise.resolve(jsonClient);
      } catch (e) {
        throw new Error("VertexAI: Failed to parse keyJson");
      }
    } else if (keyFile) {
      if (typeof keyFile !== "string") {
        throw new Error("VertexAI: keyFile must be a string");
      }
      this.clientPromise = new GoogleAuth({
        scopes: VertexAIApi.AUTH_SCOPES,
        keyFile,
      })
        .getClient()
        .catch((e: Error) => {
          console.warn(
            `Failed to load credentials for Vertex AI: ${e.message}`,
          );
        });
    } else if (!apiKey) {
      // Application Default Credentials
      this.clientPromise = new GoogleAuth({
        scopes: VertexAIApi.AUTH_SCOPES,
      })
        .getClient()
        .catch((e: Error) => {
          console.warn(
            `Failed to load credentials for Vertex AI: ${e.message}`,
          );
        });
    }
  }

  private getApiBase(): string {

View on GitHub (pinned to 5522c6f44c)

Solutions

1. Verify the key file path exists and is a valid service-account JSON: `cat $GOOGLE_APPLICATION_CREDENTIALS | jq .type` should print service_account
2. Ensure the service account has roles/aiplatform.user and the Vertex AI API is enabled in the project
3. Confirm project/region config matches the key's project
4. Prefer Application Default Credentials (`gcloud auth application-default login`) when no keyFile is needed

Example fix

# before
GOOGLE_APPLICATION_CREDENTIALS=/wrong/path/key.json

# after
GOOGLE_APPLICATION_CREDENTIALS=/secrets/valid-sa-key.json
# validate:
gcloud auth application-default print-access-token

const key = JSON.parse(await fs.readFile(keyFile, "utf8"));
if (key.type !== "service_account") throw new Error("Not a service account key");

const isServiceAccountKey = (k: any): boolean =>
  k?.type === "service_account" && !!k.client_email && !!k.private_key;

try {
  await vertexApi.clientPromise;
} catch (e) {
  throw new Error(`Vertex AI auth failed: ${e.message}`);
}

When it happens

Trigger: Configuring GOOGLE_APPLICATION_CREDENTIALS / a keyFile path that does not exist, is invalid JSON, lacks the right scopes, or the service account has no Vertex AI access; then constructing the VertexAIApi class.

Common situations: Wrong key file path in containers/CI, exporting a Workspace (not service account) JSON, key from a different GCP project, or missing Vertex AI API enablement.

Related errors

• URL is not defined in params
• Response body is null
• VertexAI: keyJson must contain a valid private key
• No workspace directories found. Make sure you've opened a fo
• VertexAI in express mode (apiKey only) cannot be configured

AI-assisted analysis of continuedev/continue@5522c6f44c (2026-08-27). Data as JSON: /api/errors/377852b7e6c29a4b. Report an issue: GitHub.