For the complete documentation index, see llms.txt. This page is also available as Markdown.

Configure delegated access for GCP Vertex AI

Overview

For Vertex AI, delegated access is typically implemented with a Google service account and short-lived OAuth access tokens generated through secure identity flows.

In production, prefer Workload Identity Federation or managed identity paths over long-lived JSON key files.

When to use this

  • Production systems where static service-account keys are discouraged.

  • Centralized IAM/security operations with scoped permissions.

  • Environments requiring frequent credential rotation and strong audit trails.

Prerequisites

  • GCP project with Vertex AI enabled.

  • Permissions to create/manage service accounts and IAM roles.

  • A service account dedicated to Flashgate AI provider access.

  • Flashgate AI LLM setup path: Configure an AI LLM.

Step-by-step (provider side)

1

Create a service account with least privilege

Create a service account for Vertex AI calls and assign only required permissions.

Use minimum roles required for your use case (for example, prediction/invocation capabilities instead of broad project admin roles).

2

Prefer short-lived credentials

Use Workload Identity / token exchange flows to obtain short-lived OAuth access tokens.

Avoid storing long-lived JSON private keys in production when possible.

3

Generate and refresh access tokens

Implement a secure token refresh mechanism (for example in a trusted backend service) that obtains fresh OAuth access tokens before expiry.

If your architecture needs a stable upstream interface, expose a small proxy that handles token acquisition and forwards requests to Vertex AI.

Configure in Flashgate

Use Configure an AI LLM with existing fields:

  • Choose the appropriate AI LLM Type for your Vertex integration.

  • Set API Endpoint to Vertex AI endpoint (or your proxy endpoint).

  • Set API Secret to the token/credential expected by that endpoint.

  • Set API Key only if your integration endpoint requires an additional key.

If your provider flow cannot be mapped directly to endpoint + secret/token, place the identity logic in a controlled proxy and configure Flashgate to call that proxy.

Last updated

Was this helpful?