Gemini CLI for Vertex AI Authentication

[ryuchan-debug]

Description of the bug:

CLI Version:
0.11.3

Operating System:
Windows

Objective:
Authenticate Gemini CLI with Google Cloud Vertex AI using a service account.

Symptoms:

• The gemini -d "Hello" command consistently fails to authenticate via Vertex AI.
• The debug output does not contain the expected Authenticated via 'vertex-ai' message.
• The debug output always contains the message Loaded cached credentials., even when all known credential caches are disabled.

Troubleshooting Steps Performed:
We have exhaustively checked and verified the following configurations and steps:

1. Environment Variables: All required variables are correctly set:
   • GOOGLE_GENAI_USE_VERTEXAI=true
   • GOOGLE_CLOUD_PROJECT
   • GOOGLE_CLOUD_LOCATION
   • GOOGLE_APPLICATION_CREDENTIALS
2. Credentials File:
   • The path points to a valid service account JSON key.
   • Tested with a direct, physical file path (e.g., C:\keys\key.json) to rule out symbolic link issues.
   • Generated a new service account key and tested with it.
3. GCP Project Settings:
   • Vertex AI API is enabled.
   • A billing account is linked to the project.
   • The service account has the "Vertex AI User" role.
4. Credential Cache:
   • The standard ADC cache file (%APPDATA%\google-auth\hs_credentials.json) does not exist.
   • The gcloud config directory (%APPDATA%\gcloud) was temporarily renamed to disable it, but this had no effect on the outcome.

Conclusion:
Despite all correct configurations, the Gemini CLI appears to be incorrectly prioritizing an unknown cached credential source and ignoring the GOOGLE_APPLICATION_CREDENTIALS environment variable. This is likely a bug in the credential loading priority chain within the CLI on Windows.

Actual vs expected behavior:

No response

Any other information you'd like to share?

No response

[ryuchan-debug]

Title: Update: Authentication issue resolved, now facing a quota issue.

Comment:

Hello, I have an important update on this issue.

Following the advice in another document, I changed the GOOGLE_CLOUD_LOCATION environment variable to
us-central1.

After this change, the original authentication problem seems to be resolved. I can now confirm the CLI
version (gemini --version returns 0.12.0), which suggests it's communicating with the Google Cloud services
correctly.

However, I am now encountering a new error:

1 [API Error: ... "code": 429, "message": "Resource exhausted.", "status": "RESOURCE_EXHAUSTED"]

It seems the problem has shifted from an authentication failure to a quota limit issue. This suggests that the
initial problem was likely related to the region configuration.

Thank you for your support.

[ryuchan-debug]

Hello,

I'm writing to provide an update and close this issue. The 429 Resource Exhausted error, which occurred despite billing being enabled, has been
successfully resolved.

The root cause was identified as the Gemini CLI not explicitly referencing the correct Google Cloud project where billing was enabled. Even though
GOOGLE_CLOUD_PROJECT environment variable was set, the CLI was not correctly picking it up, leading to it defaulting to an unset or free-tier project.

The solution involved the following steps:

1. Explicitly setting the correct Google Cloud project for the CLI:
   1 gcloud config set project [YOUR_BILLING_ENABLED_PROJECT_ID]
   (In my case, the project ID was gemini-generated-project)

2. Refreshing the authentication credentials:

1 gcloud auth application-default login

After performing these steps, the Gemini CLI correctly recognized the billing-enabled project, and the quota limits were effectively increased. The API
calls are now proceeding without the 429 error.

Thank you for your attention to this matter and for maintaining this repository. This information might be helpful for other users encountering similar
issues.

Best regards,