What opencode does

opencode's Google Vertex AI provider reads GOOGLE_CLOUD_PROJECT, VERTEX_LOCATION (default global) and GOOGLE_APPLICATION_CREDENTIALS, or uses gcloud auth application-default login.

Sources:

• https://opencode.ai/docs/providers/

What bravebot does today

A google-vertex entry is reached with an API key sent in x-goog-api-key (BACKEND-49 to BACKEND-51). docs/website/docs/customize/providers/openai-compatible.md says signing in with Google Cloud credentials instead of a key is not supported. A project whose organisation disallows API keys, or a person who only has gcloud signed in, cannot use it.

#1091 (closed) added the key path and listed Application Default Credentials as out of scope. #1093 is the express-mode native API with a key and no project. Neither covers Application Default Credentials.

Read: docs/specs/backends.md BACKEND-1, BACKEND-9, BACKEND-10, BACKEND-49, BACKEND-50, BACKEND-51, crates/config/src/provider.rs

Proposal

Add a clause to docs/specs/backends.md saying that where a google-vertex entry or the environment names a project and no key resolves, bravebot asks the Google Cloud CLI for a token with gcloud auth application-default print-access-token and sends it as a bearer token to the built host. The program is fixed by bravebot and not named by a file (BACKEND-1), as the AWS CLI is for Bedrock. The sign-in is asked for before work starts and only for the service the next request goes to (BACKEND-9), a good session is kept until near its stated expiry and dropped when a request disproves it (BACKEND-10), and GOOGLE_APPLICATION_CREDENTIALS is honoured by the tool and not read by bravebot. The clause confirms the command against Google's current documentation. Tests: no key and a project runs the tool; a key present does not; a refused token is reported and drops the kept answer; the token goes only to the built host.

Constraints

BACKEND-1, BACKEND-9, BACKEND-10, BACKEND-49, BACKEND-51, docs/specs/credential-protection.md, docs/specs/sandboxing.md SANDBOX-30 (the program is started with a reduced PATH).

Where this comes from

A comparison of opencode's provider and model options with docs/specs/backends.md and the pages under docs/website/docs/customize/providers/, at 12854a07.

Gap id: parity-vertex-application-default-credentials