AI Gateway BYOK Issue: Google Vertex AI Imagen Authentication Fails Problem Cloudflare AI Gateway's
AI Gateway BYOK Issue: Google Vertex AI Imagen Authentication Fails
Problem
Cloudflare AI Gateway's BYOK (Provider Keys) feature successfully authenticates third-party Vertex AI models (Mistral) but fails to authenticate Google's native models (Imagen), despite using the same service account configuration.
---
What Works
Mistral OCR via AI Gateway BYOK:
await env.AI.gateway("my-gateway").run({
provider: "google-vertex-ai",
endpoint: "v1/projects/my-project/locations/us-central1/publishers/mistralai/models/mistral-ocr-2505:rawPredict",
query: { model: "mistral-ocr-2505", document: {...} }
})
// 200 OK - Works perfectly
---
What Fails
Imagen 4 via AI Gateway BYOK:
await env.AI.gateway("my-gateway").run({
provider: "google-vertex-ai",
endpoint: "v1/projects/my-project/locations/us-central1/publishers/google/models/imagen-4.0-generate-001:predict",
query: {
instances: [{ prompt: "test image" }],
parameters: { sampleCount: 1 }
}
})
// 401 from Google: "CREDENTIALS_MISSING"
---
Configurations Tried
Service account has Vertex AI User IAM role
Added "region": "us-central1" to service account JSON Tested both :predict and :rawPredict endpoints - both fail Verified credentials work when calling Vertex AI directly
---
Observation
Third-party publishers (publishers/mistralai/): BYOK authentication works
Google publishers (publishers/google/): BYOK authentication fails
The AI Gateway appears to not generate or pass OAuth2 credentials correctly for Google's native Vertex AI models.
---
Question: Is this a known limitation of BYOK with Google Vertex AI native models, or should this be working?
Problem
Cloudflare AI Gateway's BYOK (Provider Keys) feature successfully authenticates third-party Vertex AI models (Mistral) but fails to authenticate Google's native models (Imagen), despite using the same service account configuration.
---
What Works
Mistral OCR via AI Gateway BYOK:
await env.AI.gateway("my-gateway").run({
provider: "google-vertex-ai",
endpoint: "v1/projects/my-project/locations/us-central1/publishers/mistralai/models/mistral-ocr-2505:rawPredict",
query: { model: "mistral-ocr-2505", document: {...} }
})
//
200 OK - Works perfectly---
What Fails
Imagen 4 via AI Gateway BYOK:
await env.AI.gateway("my-gateway").run({
provider: "google-vertex-ai",
endpoint: "v1/projects/my-project/locations/us-central1/publishers/google/models/imagen-4.0-generate-001:predict",
query: {
instances: [{ prompt: "test image" }],
parameters: { sampleCount: 1 }
}
})
//
401 from Google: "CREDENTIALS_MISSING"---
Configurations Tried
Service account has Vertex AI User IAM role Added "region": "us-central1" to service account JSON Tested both :predict and :rawPredict endpoints - both fail Verified credentials work when calling Vertex AI directly---
Observation
Third-party publishers (publishers/mistralai/): BYOK authentication works
Google publishers (publishers/google/): BYOK authentication fails
The AI Gateway appears to not generate or pass OAuth2 credentials correctly for Google's native Vertex AI models.
---
Question: Is this a known limitation of BYOK with Google Vertex AI native models, or should this be working?
