Fix Vertex AI authentication error
vertexai.init() with either Application Default Credentials or explicitly specify a service account key file to authenticate your API calls.config_error vertexai.init() with correct project and location, and authenticate via Application Default Credentials or provide a valid service account key JSON file.Why this happens
Vertex AI requires authentication via Google Cloud credentials. If your environment lacks proper credentials, or if vertexai.init() is called without correct parameters, you get errors like google.auth.exceptions.DefaultCredentialsError or 403 Permission denied. Typical error output includes:
google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials.This happens when the client cannot find Application Default Credentials (ADC) or the service account key file is missing or invalid.
import vertexai
# Broken code example without credentials
vertexai.init(project="my-project", location="us-central1")
model = vertexai.LanguageModel.from_pretrained("gemini-2.0-flash")
response = model.generate_text("Hello")
print(response.text)google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials.
The fix
Authenticate properly by setting up Application Default Credentials with gcloud auth application-default login or by specifying a service account key JSON file path in your code. Then initialize Vertex AI with vertexai.init() including your project and location. This ensures the client can authenticate and call the API successfully.
import os
import vertexai
# Option 1: Use Application Default Credentials (run 'gcloud auth application-default login' beforehand)
vertexai.init(project=os.environ["GOOGLE_CLOUD_PROJECT"], location="us-central1")
model = vertexai.LanguageModel.from_pretrained("gemini-2.0-flash")
response = model.generate_text("Hello from Vertex AI")
print(response.text)
# Option 2: Explicitly specify service account key file
# os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = "/path/to/key.json"
# vertexai.init(project="my-project", location="us-central1")Hello from Vertex AI
Preventing it in production
Use robust authentication management by:
- Setting up Application Default Credentials on your deployment environment (CI/CD, servers, or cloud functions).
- Using environment variables like
GOOGLE_APPLICATION_CREDENTIALSto point to service account keys securely. - Validating credentials before making API calls to catch errors early.
- Implementing retry logic for transient permission errors.
This ensures your Vertex AI client authenticates reliably in all environments.
Key Takeaways
- Always authenticate Vertex AI clients with Application Default Credentials or service account keys.
- Set
GOOGLE_CLOUD_PROJECTandlocationcorrectly invertexai.init(). - Validate and refresh credentials regularly to avoid runtime authentication failures.