Skip to content

feat: Add skipAuth option for custom endpoints without Google Cloud c…#1137

Closed
what-is-thy-bidding wants to merge 38 commits intogoogleapis:mainfrom
what-is-thy-bidding:skipAuth
Closed

feat: Add skipAuth option for custom endpoints without Google Cloud c…#1137
what-is-thy-bidding wants to merge 38 commits intogoogleapis:mainfrom
what-is-thy-bidding:skipAuth

Conversation

@what-is-thy-bidding
Copy link
Copy Markdown

@what-is-thy-bidding what-is-thy-bidding commented Dec 1, 2025

Why

When using custom endpoints (proxy servers) that implement the Vertex AI API format, users currently MUST provide Google Cloud credentials even though these credentials are never used for actual authentication. The custom endpoints (proxy servers) handle their own authentication (e.g., via Bearer tokens).

The credentials are stored on that proxy server and not on the client's machine locally.

This creates unnecessary friction:

  • Users must obtain a real GCP service account JSON file
  • Must set GOOGLE_APPLICATION_CREDENTIALS environment variable
  • Must provide valid project/location values
  • All of this just to initialize the SDK, even though the custom endpoint ignores these credentials entirely

Solution

Added a new `skipAuth` option to `HttpOptions` that allows users to:

  • Skip Google Cloud credential validation and loading
  • Skip project/location requirement checks
  • Bypass GoogleAuth initialization entirely
  • Skip prepending `projects/{project}/locations/{location}/` to URL paths

When `skipAuth: true`:

  1. node_client.ts skips reading env vars and validation
  2. _node_auth.ts skips GoogleAuth initialization
  3. No auth headers are added (custom endpoint handles auth via httpOptions.headers)
  4. _api_client.ts skips prepending `projects/{project}/locations/{location}/` to request paths

Why skip prependProjectLocation?

Normal Vertex AI URLs look like:
https://us-central1-aiplatform.googleapis.com/v1/projects/my-project/locations/us-central1/publishers/google/models/gemini:generateContent

Custom endpoint URLs should look like:
https://custom-endpoint.com/v1/publishers/google/models/gemini:generateContent

When `skipAuth` is set:

  • Custom endpoints don't expect the `projects/{project}/locations/{location}/` path prefix
  • With `skipAuth`, we likely don't have valid project/location values anyway (they'd be `undefined`)
  • The custom endpoint handles its own routing and doesn't need GCP resource paths

Changes

  • src/types.ts: Added `skipAuth?: boolean` to HttpOptions interface
  • src/node/_node_auth.ts: Skip GoogleAuth init when skipAuth is true
  • src/_api_client.ts: Skip project/location path prepending when skipAuth is true
  • src/node/node_client.ts: Conditional env var loading based on skipAuth

Example Usage

Before (requires REAL Google Cloud credentials):

// Step 1: Must have a real GCP service account JSON file
// Step 2: Set environment variable
process.env.GOOGLE_APPLICATION_CREDENTIALS = './service_account.json';

// Step 3: Initialize SDK (GoogleAuth tries to load credentials)
const ai = new GoogleGenAI({
  vertexai: true,
  project: 'my-gcp-project',      // Required even though never used
  location: 'us-central1',         // Required even though never used
  httpOptions: {
    baseUrl: 'https://custom-endpoint.example.com/v1/',
    headers: { 'Authorization': 'Bearer MY_CUSTOM_TOKEN' },
  },
});

// Without GOOGLE_APPLICATION_CREDENTIALS: Error - Could not load credentials
// URL would be: .../projects/my-gcp-project/locations/us-central1/publishers/... (won't work, because the location and project name isn't stored on the client's machine but on the proxy-server)

After (no Google Cloud setup needed):

// No service account file needed!
// No GOOGLE_APPLICATION_CREDENTIALS needed!
// No project/location needed!

const ai = new GoogleGenAI({
  vertexai: true,
  httpOptions: {
    baseUrl: 'https://custom-endpoint-proxy-server.com/v1/',
    headers: { 'Authorization': 'Bearer MY_CUSTOM_TOKEN' },
    skipAuth: true,  // Skip all Google Cloud authentication
  },
});

// URL will be: .../publishers/google/models/gemini:generateContent

This brings the TypeScript SDK in line with the Python SDK's behavior, where custom http_options automatically bypass Google Cloud authentication.

Loading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

api: vertex-ai Issues related to the Vertex AI API. type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants