https://www.boundaryml.com logo
Powered by
🟡 Issue switching from application credentials to...
# questions
a
In setting up vertex, I tried using their application credentials system but now am trying to switch over to using the api key. However, baml playground keeps trying to use the credential system because I have an env variable set in the playground. The trash can button clears the value of the variable but doesn't actually remove the env variable so I'm not able to test my api key usage. How can I resolve this?
a
were you able to resolve this?
one way is to go to "open webview developer tools" (ctrl + p) to access this in command pallete in vscode, then go to 'application' and clear the local storage. Youll see baml stores the api keys there
a
ah actually found it, will try to reset then
a
oh those should just be placehodlers
a
The presence of GOOGLE_APPLICATION_CREDENTIALS_CONTENT is still causing it to automatically search for google credentials file despite the variable being empty
a
ahhh i see
ok that is definitely a bug, sorry about that. What version of baml extension are you on?
can you try to remove the client that has the google_application_credentials?
you can just comment it out
or mind sending the list of clients you have defined?
a
I'm on 0.213 but let me update to 214 and give that a try as well
a
ok i think i reproduced the issue
a
before it was saying something like unable to find google credentials at character count 1:1
a
this is my client configuration:
Copy code
client<llm> VertexWithQueryParams {
  provider vertex-ai
  options {
    model gemini-2.5-flash
    location us-central1
    project_id "gloo-ai"
    query_params {
      key env.VERTEX_API_KEY
    }
  }
}
this one actually worked
the curl:
Copy code
curl -X POST 'https://us-central1-aiplatform.googleapis.com/v1/projects/gloo-ai/locations/us-central1/publishers/google/models/gemini-2.5-flash:generateContent?key=AQ..................' -H "content-type: application/json" -d "{
  \"contents\": [
    {
      \"role\": \"user\",
      \"parts\": [
        {
          \"text\": \"Write a nice story. 10 wordss.\"
        }
      ]
    }
  ]
}"
a
is it possible its because i'm trying to use anthropic model?
client Sonnet4_0Vertex { provider vertex-ai options { model "claude-sonnet-4@20250514" anthropic_version "vertex-2023-10-16" location "us-east5" project_id "opentug-ai-pipeline" query_parameters { key env.VERTEX_API_KEY } max_tokens 8192 temperature 0 } }
a
yes, i tried the anthropic model and it didnt work with an api key
i got the error above^^^
see if it works with gemini flash first?
a
I think it went through we just don't have the model enabled in our project. It makes sense that the gemini works though since it doesn't use the application credential system since it's their in house model https://cdn.discordapp.com/attachments/1441175539149832355/1442616449750274121/Screenshot_2025-11-24_at_12.41.54_PM.png?ex=692614c4&is=6924c344&hm=d05bb75d42f7eeb8a73842d7a3cd73365a91ec185d775c6508c424f88ea0b975&
Interestingly after wiping the keys and reloading window the local storage keys dont show the google application credential key yet it shows in playground https://cdn.discordapp.com/attachments/1441175539149832355/1442616697361010769/Screenshot_2025-11-24_at_12.40.06_PM.png?ex=692614ff&is=6924c37f&hm=64752232e49a27e0cfa90d515e7386f4821a92ad2c311509c6d6a23c9cda7e24&
a
yep those come from elsewhere, it depends which clients you have on your config
and perhaps there are tighter guidelines to using claude
a
So we've implemented the application default credentials system already but have had issues with it, we confirmed with Vertex folk that the api key system should work for anthropic models. The issue we're trying to resolve is not to get the application default credential system working (we've already given up on this ):) but to get the api key system working. With that system, we're told there shouldn't be a need for anything gcloud related. We're currently blocked due to baml only going to the ADC route due to the env variable presence (or something else). Is there a fix we can do to stop it from defaulting to that system so we can locally test the api key system
I can't paste the full client list due to discord message length but can send pictures so you can see if there's a client we can remove
a
are you able to get a cURL working for calling vertex with claude using an api key?
for example i got the cURL for gemini model working, but not claude -- we could start there. Once the curl works, we can see why baml doesn't. But let me show you the code we have to figure out what method to use, one sec
(the playground has a curl tab)
a
This is what the curl tab is showing - also its back to the error I had previously been getting (trying to use the glcoud auth system instead of api key system) https://cdn.discordapp.com/attachments/1441175539149832355/1442618728192933990/Screenshot_2025-11-24_at_12.50.52_PM.png?ex=692616e3&is=6924c563&hm=71f507a1d6b7c9539ae35fc1a32a1b65a3235ccb7aaae83e30a0ba773ba42140&
a
I'm happy to get on a zoom call as well if that helps. But screenshots of your clients file would help as well
a
yeah a call sounds good
can just jump into office hours?
in office hours
a
Copy code
curl -X POST 'https://us-central1-aiplatform.googleapis.com/v1/projects/gloo-ai/locations/us-central1/publishers/google/models/gemini-2.5-flash:generateContent?key=AQ.A' -H "content-type: application/json" -d "{
  \"contents\": [
    {
      \"role\": \"user\",
      \"parts\": [
        {
          \"text\": \"Write a nice story. 10 wordss.\"
        }
      ]
    }
  ]
}"
a
@aaronv (BAML) According to gcloud folk, requests to anthropic models require the auth header, do you know if this is something baml already automatically does if glcoud is installed in the project? I couldn't get the curl through baml playground to ever show the authorization header as they provided: GCloud provided curl expectation: curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d '{ "anthropic_version": "vertex-2023-10-16", "messages": [ { "role": "user", "content": "Send me a recipe for banana bread." } ], "max_tokens": 1024, "stream": true }' \ "https://aiplatform.googleapis.com/v1/projects/your-gcp-project-id/locations/global/publishers/anthropic/models/claude-haiku-4-5@20251001:streamRawPredict"
a
Ima tag @Vaibhav (BAML 🐑) to triage this one, perhaps Sam could help. Are you saying anthropic models dont support a vertex api key?
Anthropic on vertex*
then this would mean if you want to use anthropic on vertex you have to use the google application credentials approach
a
They said the vertex api key works, requests need to include the authorization header though if its to anthropic models
a
So both the api key in the url params, and the header? I noticed your example doesnt have the key= param
Like in the previous examples
That seems strange since the auth header uses the google service account auth approach, which would make adding the vertex api key anywhere else redundant
a
Agreed on that front, I'm waiting to hear back to schedule a meeting because their responses are not quite making sense...just figured I would send over what they sent in the meantime
a
Gotcha, yep it is not making sense to me either. If the vertex api key works on anthropic then there shoild be no other headers necessary as that would imply adding other forms of auth. Thanks for the update!
And also you can show them the curl working on gemini pro 3
a
Yep will do
PreviousNext
Powered by