[Enhancement]: Add standard google authentication for vertex-ai

[GregoireW]

What features would you like to see added?

Today we have to explicitly define authentication on LibreChat when we use vertexAI. The google SDK is build to automatically pull identity from different elements ( workload identity on the server, gcloud authentication, json file from a env variable... ) I'd like for LibreChat to give an option to do that.

LibreChat would interact in a "passwordless" manner with google server which is much better and much simpler on multiple occasion (one is deploying the application on gcp infra)

More details

The idea would be to add 2 env variables:

GOOGLE_CREDENTIALS_AUTO:  to tell librechat to not bother with authentication
GOOGLE_PROJECT_ID: to set the target project id 

it imply to have

GOOGLE_KEY: ""
GOOGLE_SERVICE_KEY_FILE: "{}"

A patch could look like:

diff --git a/api/app/clients/tools/structured/GeminiImageGen.js b/api/app/clients/tools/structured/GeminiImageGen.js
index c6ee58a6..2f62f836 100644
--- a/api/app/clients/tools/structured/GeminiImageGen.js
+++ b/api/app/clients/tools/structured/GeminiImageGen.js
@@ -98,33 +98,41 @@ async function initializeGeminiClient(options = {}) {
     return new GoogleGenAI({ apiKey: googleKey });
   }
 
-  // Fall back to Vertex AI with service account
-  logger.debug('[GeminiImageGen] Using Vertex AI with service account');
-  const credentialsPath = getDefaultServiceKeyPath();
-
-  // Use loadServiceKey for consistent loading (supports file paths, JSON strings, base64)
-  const serviceKey = await loadServiceKey(credentialsPath);
+  if (process.env.GOOGLE_CREDENTIALS_AUTO === 'true') {
+    return new GoogleGenAI({
+      vertexai: true,
+      project: process.env.GOOGLE_PROJECT_ID,
+      location: process.env.GOOGLE_LOC || process.env.GOOGLE_CLOUD_LOCATION || 'global',
+    });
+  } else {
+    // Fall back to Vertex AI with service account
+    logger.debug('[GeminiImageGen] Using Vertex AI with service account');
+    const credentialsPath = getDefaultServiceKeyPath();
+
+    // Use loadServiceKey for consistent loading (supports file paths, JSON strings, base64)
+    const serviceKey = await loadServiceKey(credentialsPath);
+
+    if (!serviceKey || !serviceKey.project_id) {
+      throw new Error(
+        'Gemini Image Generation requires one of: user-provided API key, GEMINI_API_KEY or GOOGLE_KEY env var, or a valid Google service account. ' +
+          `Service account file not found or invalid at: ${credentialsPath}`,
+      );
+    }
 
-  if (!serviceKey || !serviceKey.project_id) {
-    throw new Error(
-      'Gemini Image Generation requires one of: user-provided API key, GEMINI_API_KEY or GOOGLE_KEY env var, or a valid Google service account. ' +
-        `Service account file not found or invalid at: ${credentialsPath}`,
-    );
-  }
+    // Set GOOGLE_APPLICATION_CREDENTIALS for any Google Cloud SDK dependencies
+    try {
+      await fs.promises.access(credentialsPath);
+      process.env.GOOGLE_APPLICATION_CREDENTIALS = credentialsPath;
+    } catch {
+      // File doesn't exist, skip setting env var
+    }
 
-  // Set GOOGLE_APPLICATION_CREDENTIALS for any Google Cloud SDK dependencies
-  try {
-    await fs.promises.access(credentialsPath);
-    process.env.GOOGLE_APPLICATION_CREDENTIALS = credentialsPath;
-  } catch {
-    // File doesn't exist, skip setting env var
+    return new GoogleGenAI({
+      vertexai: true,
+      project: serviceKey.project_id,
+      location: process.env.GOOGLE_LOC || process.env.GOOGLE_CLOUD_LOCATION || 'global',
+    });
   }
-
-  return new GoogleGenAI({
-    vertexai: true,
-    project: serviceKey.project_id,
-    location: process.env.GOOGLE_LOC || process.env.GOOGLE_CLOUD_LOCATION || 'global',
-  });
 }
 
 /**
diff --git a/packages/api/src/endpoints/google/llm.ts b/packages/api/src/endpoints/google/llm.ts
index 289bc0e9..2ccaaeea 100644
--- a/packages/api/src/endpoints/google/llm.ts
+++ b/packages/api/src/endpoints/google/llm.ts
@@ -143,7 +143,11 @@ export function getGoogleConfig(
     typeof serviceKeyRaw === 'string' ? JSON.parse(serviceKeyRaw) : (serviceKeyRaw ?? {});
 
   const apiKey = creds[AuthKeys.GOOGLE_API_KEY] ?? null;
-  const project_id = !apiKey ? (serviceKey?.project_id ?? null) : null;
+  const project_id = !apiKey
+    ? process.env.GOOGLE_PROJECT_ID
+      ? process.env.GOOGLE_PROJECT_ID
+      : (serviceKey?.project_id ?? null)
+    : null;
 
   const reverseProxyUrl = options.reverseProxyUrl;
   const authHeader = options.authHeader;
@@ -183,10 +187,13 @@ export function getGoogleConfig(
 
   // If we have a GCP project => Vertex AI
   if (provider === Providers.VERTEXAI) {
-    (llmConfig as VertexAIClientOptions).authOptions = {
-      credentials: { ...serviceKey },
-      projectId: project_id,
-    };
+    (llmConfig as VertexAIClientOptions).authOptions =
+      process.env.GOOGLE_CREDENTIALS_AUTO === 'true'
+        ? { projectId: project_id }
+        : {
+            credentials: { ...serviceKey },
+            projectId: project_id,
+          };
     (llmConfig as VertexAIClientOptions).location = process.env.GOOGLE_LOC || 'us-central1';
   } else if (apiKey && provider === Providers.GOOGLE) {
     llmConfig.apiKey = apiKey;

Which components are impacted by your request?

Endpoints

Pictures

No response

Code of Conduct

• I agree to follow this project's Code of Conduct