My google-vertex LLMs have all stopped working in 2026.4.12 | Friends of the Crustacean 🦞🤝 | Page 1

elfin epoch Apr 13, 2026, 3:00 PM

#

Upgraded from 2026.3.28. My google-vertex/gemini-2.5-flash does not work anymore. Also google-vertex LLMs for that matter all stopped working:

LLM error: {
  "error": {
    "code": 401,
    "message": "API keys are not supported by this API. Expected OAuth2 access token or other authentication credentials that assert a principal. See https://cloud.google.com/docs/authentication",
    "status": "UNAUTHENTICATED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "CREDENTIALS_MISSING",
        "domain": "googleapis.com",
        "metadata": {
          "method": "google.cloud.aiplatform.v1.PredictionService.StreamGenerateContent",
          "service": "aiplatform.googleapis.com"
        }
      }
    ]
  }
}

primal belfryBOT Apr 13, 2026, 3:00 PM

#

bitter tangleBOT Apr 13, 2026, 3:00 PM

#

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

primal belfryBOT Apr 13, 2026, 3:00 PM

#

elfin epoch Apr 13, 2026, 3:04 PM

#

nudge

#

Hi @unborn flax ! You are the only one who can help me out !!! Don't abandon me !!!!! Please !! Pretty please !!!

unborn flaxBOT Apr 13, 2026, 3:10 PM

#

I got you, not abandoning you 🤝

That 401 means Vertex got an API key instead of OAuth/ADC creds.

Please run these in order:

openclaw --version
openclaw models status

If you want to keep using google-vertex/*, do this on the gateway host:

unset GOOGLE_CLOUD_API_KEY
gcloud auth application-default login

#

export GOOGLE_CLOUD_PROJECT="YOUR_PROJECT_ID"
export GOOGLE_CLOUD_LOCATION="us-central1"   # or your region
openclaw gateway restart
openclaw models status

If your gateway runs as a daemon, put GOOGLE_CLOUD_PROJECT + GOOGLE_CLOUD_LOCATION in ~/.openclaw/.env (not just your shell), then restart gateway.

If you want API-key auth instead, switch model to google/gemini-2.5-flash (not google-vertex/*).

Docs:

Paste openclaw --version + openclaw models status output and I’ll help you finish this fast.

elfin epoch Apr 13, 2026, 3:12 PM

#

It was working just now when I was still on 2026.3.28. no configuration changes at all. 2026.4.12 must have broken something.

I run my openclaw on docker, has been relying on the 3 environment variables to make oauth work. But it doesn't seem to work anymore

unborn flaxBOT Apr 13, 2026, 3:16 PM

#

You’re absolutely right, this smells like a regression in 2026.4.12 around google-vertex auth handling.

For Docker, try this exact checklist first:

Set these env vars in the container (explicitly):
- GOOGLE_APPLICATION_CREDENTIALS=/path/in/container/sa.json
- GOOGLE_CLOUD_PROJECT=...
- GOOGLE_CLOUD_LOCATION=... ← important (not just CLOUD_ML_REGION)
Make sure the creds file is actually mounted/readable in the container.
Unset API-key auth vars for Vertex path:
- GOOGLE_CLOUD_API_KEY
- (temporarily) GEMINI_API_KEY / GOOGLE_API_KEY
  These can cause fallback to API-key auth, which Vertex stream rejects.
Restart container/gateway, then run:

#

openclaw --version
openclaw models status
openclaw status --all

If you want, paste your (redacted) Docker env block and I’ll sanity-check it line by line.

Quick unblock: switch to google/gemini-2.5-flash (non-vertex) until this is fixed.

If this still reproduces after the checklist, please open an issue with logs here: https://github.com/openclaw/openclaw/issues
and include the exact 401 body + openclaw --version.

Docs: https://docs.openclaw.ai/concepts/model-providers#google-vertex-and-gemini-cli

glacial marsh Apr 13, 2026, 3:24 PM

#

elfin epoch It was working just now when I was still on 2026.3.28. no configuration changes...

u don’t know that Anthropic blocked OpenClaw?

unborn flaxBOT Apr 13, 2026, 3:24 PM

#

Short answer: no, Anthropic has not globally “blocked OpenClaw.”

Per current docs, Anthropic API-key auth works, and Claude CLI/subscription auth is also currently supported in OpenClaw.

This thread’s error is from Google Vertex auth (aiplatform.googleapis.com), so it is a separate issue.

elfin epoch Apr 13, 2026, 3:40 PM

#

i have this in my openclaw.json:

  "auth": {
    "profiles": {
      "google:default": {
        "provider": "google",
        "mode": "api_key"
      }
    }
  },

I also have this in my auth-profiles.json for each of my agents:

{
  "version": 1,
  "profiles": {
    "google:default": {
      "type": "api_key",
      "provider": "google",
      "key": "<redacted>"
    }
  },
  "lastGood": {
    "google": "google:default"
  },
  "usageStats": {
    "google:default": {
      "errorCount": 0,
      "lastUsed": 1775395539698,
      "lastFailureAt": 1775358500168
    }
  }
}

Thing is, even with these, google-vertex still worked on 2026.3.28. What should I do to try and see if I can get it to work, before I fallback to 2026.3.28?

unborn flaxBOT Apr 13, 2026, 3:43 PM

#

This is super helpful, and it explains the behavior.

Your shown profile is for provider: "google" + API key.
google-vertex/* now really wants ADC/OAuth-style credentials, not that API-key profile.

Before downgrading, do this clean test:

In Docker env, keep only Vertex auth inputs:
- GOOGLE_APPLICATION_CREDENTIALS (mounted file path inside container)
- GOOGLE_CLOUD_PROJECT
- GOOGLE_CLOUD_LOCATION
Temporarily remove/unset key-based vars:
- GEMINI_API_KEY
- GOOGLE_API_KEY
- GOOGLE_CLOUD_API_KEY

#

Temporarily remove the google:default API-key profile (or test with a fresh agent auth store) so google key auth cannot be reused.
Restart gateway/container and run:

openclaw --version
openclaw models status
openclaw status --all

If Vertex works after this, root cause is key-auth fallback contamination from google auth.

If you need both in parallel, safest setup is:

one agent/provider path for google/* (API key),
another for google-vertex/* (ADC).

Docs: https://docs.openclaw.ai/concepts/model-providers#google-vertex-and-gemini-cli

#

If it still fails after the clean test, it’s likely a regression, please file with those outputs: https://github.com/openclaw/openclaw/issues

elfin epoch Apr 13, 2026, 3:50 PM

#

your step 2, do you mean environment variables of these names ? If yes, I have none of those. Also, what do you mean by an "agent/provider path" ? Yes i can see myself using both (one for one or more of my agents, another for image generation for example)

unborn flaxBOT Apr 13, 2026, 3:50 PM

#

Yep, by step 2 I meant environment variable names exactly.
If you have none of those key vars, great, then skip that step.

For your case, next best check is this:

openclaw models status

If google-vertex shows auth source tied to google:default (API key), that is the conflict.

What I meant by “agent/provider path”

Just this: use different agents for different auth/model setups.

Agent A (Vertex chat):
- model: google-vertex/...
- auth: ADC env (GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_CLOUD_PROJECT, GOOGLE_CLOUD_LOCATION)

#

no Google API-key profile
Agent B (Google API-key stuff, e.g. image generation):
- provider/model: google/...
- auth profile: google:default API key

That keeps Vertex OAuth/ADC and Google API-key traffic from stepping on each other.

If you want, paste the google + google-vertex sections from openclaw models status and I’ll tell you exactly which line is wrong.

elfin epoch Apr 13, 2026, 3:52 PM

#

so just try removing the auth-profiles.json file altogether, or just remove the "profiles" section and / or "lastGood" section of the JSON?

unborn flaxBOT Apr 13, 2026, 3:52 PM

#

Great question.
I would not delete the whole file first.

Do a minimal test edit instead:

Backup it.
In auth-profiles.json, remove only:
- profiles["google:default"]
- lastGood["google"]
- (optional) usageStats["google:default"]
Keep everything else.
Restart gateway/container, then retry google-vertex/....

So yes, remove that specific profile mapping, not the entire auth-profiles.json unless this is a disposable test agent.

If you want, paste the edited JSON skeleton (redacted) and I’ll sanity-check before you restart.

elfin epoch Apr 13, 2026, 4:00 PM

#

still no go... i am reverting to 2026.3.28

unborn flaxBOT Apr 13, 2026, 4:00 PM

#

Totally fair, I’d do the same in your spot.

Good temporary move: pin Docker to v2026.3.28 so it stays stable.

Please file this as a regression so it gets fixed:
https://github.com/openclaw/openclaw/issues

Include:

works on 2026.3.28, fails on 2026.4.12
exact 401 (PredictionService.StreamGenerateContent, API keys are not supported)
Docker setup + Vertex env vars (names only, values redacted)
openclaw --version and openclaw models status

If you want, I can draft a copy-paste issue template for you in one message.

elfin epoch Apr 13, 2026, 4:08 PM

#

please

unborn flaxBOT Apr 13, 2026, 4:09 PM

#

Absolutely. Here is a copy-paste issue draft:

### Summary
Regression: `google-vertex/*` works on `2026.3.28` but fails on `2026.4.12` with Vertex auth error.

### Version
- Working: `2026.3.28`
- Broken: `2026.4.12`
- Install mode: Docker

### What I expected
`google-vertex/gemini-2.5-flash` should continue to work with unchanged config.

### What happened
All `google-vertex/*` models fail with:

#


```json
{
  "error": {
    "code": 401,
    "message": "API keys are not supported by this API. Expected OAuth2 access token or other authentication credentials that assert a principal.",
    "status": "UNAUTHENTICATED",
    "details": [
      {
        "reason": "CREDENTIALS_MISSING",
        "metadata": {
          "method": "google.cloud.aiplatform.v1.PredictionService.StreamGenerateContent",
          "service": "aiplatform.googleapis.com"
        }
      }
    ]

#

}
}


### Relevant auth/config details
- Existing auth profile:
  - `provider: "google"`
  - `mode/type: "api_key"`
- `google-vertex` previously worked on `2026.3.28` with no config changes.
- Tested removing `google:default` profile / `lastGood.google` from agent auth profile, still fails.
- (Add your env var names here, values redacted)

### Commands/output
Please see attached outputs:
- `openclaw --version`
- `openclaw models status`

#

- `openclaw status --all`

### Notes
Likely regression in `google-vertex` auth resolution/fallback behavior between `2026.3.28` and `2026.4.12`.

Issue link: https://github.com/openclaw/openclaw/issues/new

If this helped, after posting the issue, share the link here and I can help tighten repro details.

elfin epoch Apr 13, 2026, 4:09 PM

#

went back to 2026.3.28, and google-vertex is working once again. Zero config changes.

unborn flaxBOT Apr 13, 2026, 4:09 PM

#

Perfect, that confirms it’s a real regression in 2026.4.12 👍

You did exactly the right validation, same config, only version changed.

If you haven’t posted yet, add this line to the issue:

“Reverting to 2026.3.28 immediately restores google-vertex with zero config changes.”

Keep pinned on 2026.3.28 for now, and once you share the issue link here, I can help refine details for maintainers fast.

elfin epoch Apr 13, 2026, 4:11 PM

#

issue template is.... "Bug"? If it is, your details are pretty hard to match the different headings / sections of the bug report

unborn flaxBOT Apr 13, 2026, 4:12 PM

#

Yep, use Bug report.
Here is a form-mapped version you can paste field-by-field.

Bug type
Regression (worked before, now fails)

Beta release blocker
No

Summary
After upgrading from 2026.3.28 to 2026.4.12 (Docker), google-vertex/gemini-2.5-flash fails with 401 UNAUTHENTICATED; reverting to 2026.3.28 restores functionality with zero config changes.

Steps to reproduce

Run OpenClaw 2026.4.12 in Docker with the same config that worked on 2026.3.28.
Use model google-vertex/gemini-2.5-flash.
Observe failure with 401 from aiplatform.googleapis.com (PredictionService.StreamGenerateContent).
Revert image/version to 2026.3.28 with no config changes.

#

Observe google-vertex works again.

Expected behavior
google-vertex/gemini-2.5-flash should continue working, as observed on 2026.3.28 with identical config.

Actual behavior
On 2026.4.12, google-vertex requests fail with 401 UNAUTHENTICATED and message "API keys are not supported by this API..." for PredictionService.StreamGenerateContent.

OpenClaw version
Broken: 2026.4.12 | Last known good: 2026.3.28

Operating system
<fill your Docker host OS/version>

Install method
docker

#

Model
google-vertex/gemini-2.5-flash

Provider / routing chain
openclaw -> google-vertex -> Google Vertex AI (aiplatform.googleapis.com)

Additional provider/model setup details

Existing auth profile includes google:default (provider: google, mode/type: api_key).
No config changes between working and broken versions.
Regression reproduces across google-vertex models.
Reverting version only (no config edits) restores functionality.

Logs, screenshots, and evidence
Paste the exact 401 JSON (the one you posted in thread), plus outputs of:

openclaw --version
openclaw models status
openclaw status --all

#

Impact and severity

Affected: users relying on google-vertex/* in Docker.
Severity: high (blocks model usage).
Frequency: always observed on 2026.4.12 in this setup.
Consequence: cannot use Vertex models unless downgraded.

Additional information
Last known good: 2026.3.28. First known bad: 2026.4.12. Temporary workaround: downgrade to 2026.3.28.

If you want, after you submit, drop the issue link and I’ll help tighten it further.

elfin epoch Apr 13, 2026, 4:15 PM

#

what should the title be of the bug report?

unborn flaxBOT Apr 13, 2026, 4:15 PM

#

Use this:

[Bug]: Regression: google-vertex models fail with 401 UNAUTHENTICATED on 2026.4.12 (works on 2026.3.28)

elfin epoch Apr 13, 2026, 4:16 PM

#

created: https://github.com/openclaw/openclaw/issues/66046

unborn flaxBOT Apr 13, 2026, 4:16 PM

#

Perfect, thank you for filing it so quickly 🙌
Issue link noted: https://github.com/openclaw/openclaw/issues/66046

You’re in a good state now on 2026.3.28 until a fix lands.

Glad that helped! 🎉
If this thread helped you get unblocked, please right-click the solution message → Apps → ✅ Mark Solution so Answer Overflow indexes it for others.

#My google-vertex LLMs have all stopped working in 2026.4.12

What I meant by “agent/provider path”