fix(genai): Prevent ADC lookup delay when initializing VertexAI with API key by ADITYAKUMARRAI2007 · Pull Request #1486 · langchain-ai/langchain-google

ADITYAKUMARRAI2007 · 2025-12-31T00:26:20Z

Description

Fixes #1485,
Fixes #1473.

When initializing ChatGoogleGenerativeAI with vertexai=True and a provided api_key, the client previously triggered a default credentials lookup (ADC). On local machines without Google Cloud credentials, this lookup causes a blocking delay of ~10-12 seconds before timing out and falling back to the API key.

This PR optimizes the initialization logic to skip the ADC lookup if an API key is explicitly provided but no credentials are found.

Changes

Modified ChatGoogleGenerativeAI.validate_environment in libs/genai/langchain_google_genai/chat_models.py.
Added logic to inject AnonymousCredentials and a placeholder project ID when vertexai=True and only an api_key is present.
This explicitly tells the google-auth library to skip the environment scan, reducing initialization latency from ~11s to <1s.

Verification

Reproduction Script: Confirmed that the startup delay dropped from ~11s to <1s.
Unit Tests: Ran pytest tests/unit_tests/test_chat_models.py - All 178 tests passed.
Functional Test: Verified that standard Gemini calls (vertexai=False) function correctly with normal latency (~1.4s).

Copilot

Pull request overview

This PR fixes a performance issue where initializing ChatGoogleGenerativeAI with vertexai=True and an API key (but no credentials) caused a ~10-12 second delay due to Application Default Credentials (ADC) lookup. The fix optimizes initialization by providing AnonymousCredentials and a placeholder project ID when using API key authentication, reducing startup latency to under 1 second.

Injects AnonymousCredentials when API key is provided without explicit credentials to skip ADC lookup
Provides a placeholder project ID ("missing-project-id") when none is specified to prevent slow project ID lookups
Adds allowed_objects="all" parameter to the serialization test

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
libs/genai/langchain_google_genai/chat_models.py	Added logic to use AnonymousCredentials and placeholder project ID when initializing Vertex AI client with API key authentication
libs/genai/tests/unit_tests/test_chat_models.py	Added allowed_objects parameter to the loads function call in test_serialize

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Mason Daugherty (mdrxy) · 2025-12-31T04:07:21Z

this implementation looks like it breaks API authentication at first glance. will investigate more later

ADITYAKUMARRAI2007 · 2025-12-31T09:26:06Z

Thanks for the review Mason Daugherty (@mdrxy)!

I understand the concern regarding AnonymousCredentials. To clarify: this change is strictly scoped to the scenario where the user provides an explicit api_key but no credentials object.

Currently, if a user provides only an api_key with vertexai=True, the Google Auth library triggers a default credential lookup (ADC) effectively ignoring the API key during the initial handshake. This lookup hangs for ~10s on machines without local gcloud credentials.

By passing AnonymousCredentials in this specific case, we bypass the ADC search. The SDK then correctly authenticates using the api_key (which is passed to the client/environment), mirroring the behavior of the standard genai client.

Also, it appears the integration tests failed with a 429 RESOURCE_EXHAUSTED (quota) error, which seems unrelated to this change.

ADITYAKUMARRAI2007 · 2025-12-31T22:14:56Z

Mason Daugherty (@mdrxy) I have pushed the final fixes.

Summary of updates:

Safety Logic: Added robust checks for GOOGLE_APPLICATION_CREDENTIALS and the default gcloud file path. Anonymous mode is only forced if absolutely no standard credentials exist on the machine.
Tests Fixed: Restored the missing _set_model_profile method and updated the test snapshots to match the correct profile loading behavior.
Linting: Resolved all whitespace and line-length errors.

All CI checks are passing. Ready for your final review!

Ian Spektor (ianspektor) · 2026-01-05T16:51:35Z

Mason Daugherty (@mdrxy) hi! Just for planning purposes - is there some sort of ETA on when we could expect this to be merged/available for use? We're trying to migrate from consuming Gemini from AI Studio to Vertex AI ASAP for its better latency, and blocked until this is resolved. Thanks in advance!

Ian Spektor (ianspektor) · 2026-01-05T16:54:41Z

Also, ADITYAKUMARRAI2007: I see you've also linked this issue to the PR. Wanted to confirm whether this fixes the behavior of not being able to specify location= when using an API key I mentioned over there? Thanks for your work!

ADITYAKUMARRAI2007 · 2026-01-05T18:38:50Z

Hi Ian Spektor (@ianspektor), thanks for checking in!

Regarding #1473 and location=: Yes, this fixes it. Currently, the client crashes with a DefaultCredentialsError before it can fully initialize, which prevents any parameters (like location) from working. My fix bypasses that crash by injecting anonymous credentials when an API key is present, allowing the client to initialize correctly and respect your location config.

Mason Daugherty (@mdrxy) Re: CI, the llm-integration-tests failed due to a timeout (44m), which looks like an infrastructure flake. Could you please re-run the checks when you have a moment? I am ready for the final review.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-12T10:24:05Z

+                if os.name == "nt":  # Windows
+                    default_path = os.path.join(
+                        os.environ.get("APPDATA", ""),
+                        "gcloud",
+                        "application_default_credentials.json",
+                    )


The fallback for APPDATA environment variable may result in an invalid path. If APPDATA is not set (uncommon but possible), os.environ.get("APPDATA", "") returns an empty string, leading to a path starting with just "gcloud". This could cause unexpected behavior when checking os.path.exists(default_path). Consider using a more robust approach or adding a guard to skip the check if APPDATA is empty.

Copilot · 2026-01-12T10:24:06Z

+            if google_api_key and client_credentials is None:
+                # Check 1: Env Var
+                has_env_var = "GOOGLE_APPLICATION_CREDENTIALS" in os.environ
+
+                # Check 2: Default File Path
+                if os.name == "nt":  # Windows
+                    default_path = os.path.join(
+                        os.environ.get("APPDATA", ""),
+                        "gcloud",
+                        "application_default_credentials.json",
+                    )
+                else:  # Mac/Linux
+                    default_path = os.path.join(
+                        os.path.expanduser("~"),
+                        ".config",
+                        "gcloud",
+                        "application_default_credentials.json",
+                    )
+
+                has_default_file = os.path.exists(default_path)
+
+                # Only force Anonymous if absolutely NO standard credentials exist
+                if not has_env_var and not has_default_file:
+                    client_credentials = AnonymousCredentials()  # type: ignore


The new credential detection logic lacks dedicated test coverage. While the PR description mentions running existing unit tests, there are no new tests specifically verifying that AnonymousCredentials are correctly injected when using vertexai=True with only an API key and no credentials files. Consider adding tests that verify the credentials parameter passed to the Client when: (1) GOOGLE_APPLICATION_CREDENTIALS is not set and the default file doesn't exist, (2) GOOGLE_APPLICATION_CREDENTIALS is set, and (3) the default credentials file exists.

Copilot · 2026-01-12T10:24:06Z

+
+                # Only force Anonymous if absolutely NO standard credentials exist
+                if not has_env_var and not has_default_file:
+                    client_credentials = AnonymousCredentials()  # type: ignore


Using AnonymousCredentials bypasses the standard Google authentication flow. While this is intentional to avoid the ADC lookup delay, ensure this doesn't inadvertently expose API calls that should require proper authentication. The API key authentication should still be enforced by the backend service, but it would be good to verify that the Client with AnonymousCredentials and an API key functions correctly and securely in the VertexAI context.

Copilot · 2026-01-12T10:24:06Z

+                # Check 1: Env Var
+                has_env_var = "GOOGLE_APPLICATION_CREDENTIALS" in os.environ
+
+                # Check 2: Default File Path
+                if os.name == "nt":  # Windows
+                    default_path = os.path.join(
+                        os.environ.get("APPDATA", ""),
+                        "gcloud",
+                        "application_default_credentials.json",
+                    )
+                else:  # Mac/Linux
+                    default_path = os.path.join(
+                        os.path.expanduser("~"),
+                        ".config",
+                        "gcloud",
+                        "application_default_credentials.json",
+                    )
+
+                has_default_file = os.path.exists(default_path)


The inline comments explain the fix well, but the logic for checking credentials could be more maintainable. The hardcoded paths for different operating systems duplicate logic that might already exist in the google-auth library. Consider checking if there's a utility function from google.auth that can be used to determine if default credentials are available, or at minimum, extract this credential detection logic into a separate helper function for better testability and maintainability.

Alon Nahmias (alonahmias) · 2026-01-13T07:24:44Z

Mason Daugherty (@mdrxy) hey, we are encountering the same issue, and it holds our project back until a fix, is there any chance you can get this pr going?

ADITYAKUMARRAI2007 · 2026-01-13T08:03:16Z

"Alon Nahmias (@alonahmias) Thanks for confirming! It’s good to know I'm not the only one blocked by this.

Mason Daugherty (@mdrxy) It seems this issue is affecting multiple users now (myself, Ian Spektor (@ianspektor), and Alon Nahmias (@alonahmias)).

Regarding the build failure: I've investigated the logs (see my comment above), and the failure in test_context_caching is an AssertionError unrelated to my Auth changes. Since the Unit Tests are passing (248 passed) and the fix is verified by the community, could we please merge this to unblock everyone?"

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Ian Spektor (ianspektor) · 2026-01-16T13:43:25Z

Mason Daugherty (@mdrxy) hi 👋🏼 any updates/ETA on this? would be extremely useful to understand if we need to find a workaround on our end or its safe to wait for a fix coming from langchain. thanks in advance!

Ian Spektor (ianspektor) · 2026-01-19T21:46:41Z

ADITYAKUMARRAI2007 we've switched to authenticating with service account credentials to bypass this issue, but we're still seeing a slower first request than subsequent ones (~1.5s vs ~0.5-0.7 on subsequent ones). Does that make any sense to you?

Run 1: 1.522s (warm-up, ignored)
Run 2: 0.610s
Run 3: 0.885s
Run 4: 0.599s
Run 5: 0.726s
Run 6: 0.621s
...

repro steps are the same ones as in my original issue #1485, only passing credentials=credentials, project=<project id> and location="us-central1" to ChatGoogleGenerativeAI instead of api_key, and creating credentials as:

credentials = service_account.Credentials.from_service_account_info(
   <service account JSON>,
    scopes=["https://www.googleapis.com/auth/cloud-platform"],
)

ADITYAKUMARRAI2007 · 2026-01-19T22:49:06Z

Hi Ian Spektor (@ianspektor),

Yes, your observation makes perfect sense!

The ~1.5s "warm-up" you are seeing is the standard cold-start overhead (TCP/TLS handshake + token exchange), while subsequent requests (~0.6s) reuse the connection. This confirms that your Service Account workaround is successfully bypassing the bug.

To explain the approach in this PR versus your workaround:

Your Workaround (Service Account): By providing a Service Account, you give the client valid credentials immediately. This prevents the library from triggering the fallback "search" for default credentials, which is what causes the hang.

My Approach (This PR): This PR fixes the root cause so users can use API Keys (which are simpler) without that penalty.

The Problem: Currently, if you provide only an API key, the client triggers a 10-12s "Application Default Credentials" (ADC) lookup that hangs until it times out.

The Solution: I updated the initialization logic to inject AnonymousCredentials when only an API key is present. This explicitly tells the auth library to skip the ADC lookup entirely.

Why this PR is better: While your workaround is effective, it requires managing sensitive Service Account JSON files. This PR allows the standard API Key authentication to achieve that same fast startup (~1s) natively, keeping the setup simple.

Glad the service account method is unblocking you for now!

Ian Spektor (ianspektor) · 2026-01-20T13:35:10Z

the standard cold-start overhead (TCP/TLS handshake + token exchange)

Oh, got it. What's the recommended way to get around this? We are instantiating a new model on every call, so I'm running into this cold start on every message during a voice call, which adds 1s latency every time. Do you happen to know if there's any reference docs for this use case? I'm guessing doing a mock empty request when I instantiate the model + then reusing the model should do the trick, but asking just in case. Thank you! ADITYAKUMARRAI2007

Aaron Lim (aaron-lim-es) · 2026-01-28T02:09:39Z

Hi ADITYAKUMARRAI2007

We migrated from ChatVertexAI to ChatGoogleGenerativeAI with vertexai=True and ran A/B testing on our LangGraph agent using Gemini 2.5 Flash, and have been facing latency issues.

Setup:

Gemini 2.5 Flash on Vertex AI (Cloud Run with ADC)
langchain-google-genai 4.2.0
Same model, prompts, and test suite for both experiments

Results - Median latency comparison:

Category	ChatVertexAI	ChatGoogleGenerativeAI	Regression
category 1 (no tool calling)	1.7s	5.9s	+247%
category 2 (with tool calling)	4.1s	7.7s	+88%
category 3 (with tool calling)	8.9s	15.6s	+75%
category 4 (with tool calling)	12.6s	21.0s	+67%
category 5 (with tool calling)	11.0s	20.5s	+86%

We're seeing 50-90% latency increases consistently across query types.
I'm guessing this can be due to the to the "standard cold-start overhead (TCP/TLS handshake + token exchange)" issue mentioned in the previous comments?
Are there any steps that we can take or others have done to mitigate this?
Or is the best way to go is to wait for this to be fixed in ChatGoogleGenerativeAI?

Shoham Yamin (shohamyamin) · 2026-02-01T16:14:19Z

Any update or eta for that PR?

Mario (mpapathimiu) · 2026-03-13T09:59:04Z

This is still an issue on langchain_google_genai v4.2.1. We are migrating to Gemini models and region control is a requirement for GDPR compliance, and I spent a lot of time investigating this issue, because the documentation still says that setting the location while authenticating using API key is possible. Is using the service account credentials the only viable solution?

Aravind Manoj (aravind-manoj) · 2026-05-03T12:29:36Z

Is there any update on this?

fix: Prevent ADC lookup delay when initializing VertexAI with API key

65ec333

Copilot AI review requested due to automatic review settings December 31, 2025 00:26

Copilot started reviewing on behalf of ADITYAKUMARRAI2007 December 31, 2025 00:26 View session

Copilot AI reviewed Dec 31, 2025

View reviewed changes

Comment thread libs/genai/tests/unit_tests/test_chat_models.py

Comment thread libs/genai/langchain_google_genai/chat_models.py Outdated

Comment thread libs/genai/langchain_google_genai/chat_models.py

ADITYAKUMARRAI2007 added 4 commits December 31, 2025 06:03

style: Fix E501 line too long lint errors

9b37140

style: Fix lint formatting errors

8d6378f

style: Fix formatting and revert test change

e325119

chore: Add type ignore for AnonymousCredentials

093ac47

Mason Daugherty (mdrxy) self-assigned this Dec 31, 2025

Mason Daugherty (mdrxy) added the genai `langchain-google-genai` package label Dec 31, 2025

Mason Daugherty (mdrxy) changed the title ~~fix: Prevent ADC lookup delay when initializing VertexAI with API key~~ fix(genai(: Prevent ADC lookup delay when initializing VertexAI with API key Dec 31, 2025

Mason Daugherty (mdrxy) changed the title ~~fix(genai(: Prevent ADC lookup delay when initializing VertexAI with API key~~ fix(genai): Prevent ADC lookup delay when initializing VertexAI with API key Dec 31, 2025

ADITYAKUMARRAI2007 force-pushed the fix/vertexai-init-delay branch 4 times, most recently from 8adf4ff to 5e5bcca Compare December 31, 2025 21:38

fix: apply safety check logic for ADC credentials

dac644f

ADITYAKUMARRAI2007 force-pushed the fix/vertexai-init-delay branch 2 times, most recently from 9170941 to db1cbf6 Compare December 31, 2025 21:56

fix: apply safety logic and fix lint whitespace

d563f99

ADITYAKUMARRAI2007 force-pushed the fix/vertexai-init-delay branch 2 times, most recently from d868009 to d563f99 Compare December 31, 2025 22:08

ADITYAKUMARRAI2007 added 2 commits January 1, 2026 03:39

test: update snapshots to match new profile logic

e043fee

Merge branch 'main' into fix/vertexai-init-delay

60bb88c

Merge branch 'main' into fix/vertexai-init-delay

35627dd

Merge branch 'main' into fix/vertexai-init-delay

cc24852

ADITYAKUMARRAI2007 requested a review from Copilot January 12, 2026 10:17

Copilot started reviewing on behalf of ADITYAKUMARRAI2007 January 12, 2026 10:17 View session

Copilot AI reviewed Jan 12, 2026

View reviewed changes

ADITYAKUMARRAI2007 added 2 commits January 12, 2026 16:01

trigger ci: retry integration tests

4f760f2

Merge branch 'main' into fix/vertexai-init-delay

45768ba

Merge branch 'main' into fix/vertexai-init-delay

78889b8

ADITYAKUMARRAI2007 requested a review from Copilot January 14, 2026 19:33

Copilot started reviewing on behalf of ADITYAKUMARRAI2007 January 14, 2026 19:34 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

Comment thread libs/genai/langchain_google_genai/chat_models.py

Comment thread libs/genai/langchain_google_genai/chat_models.py

Comment thread libs/genai/langchain_google_genai/chat_models.py

Merge branch 'main' into fix/vertexai-init-delay

b1b6855

Merge branch 'main' into fix/vertexai-init-delay

d2be1e9

Merge branch 'main' into fix/vertexai-init-delay

b4e4653

Merge branch 'main' into fix/vertexai-init-delay

803bb7f

Conversation

ADITYAKUMARRAI2007 commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mason Daugherty (mdrxy) commented Dec 31, 2025

Uh oh!

ADITYAKUMARRAI2007 commented Dec 31, 2025

Uh oh!

ADITYAKUMARRAI2007 commented Dec 31, 2025

Uh oh!

Ian Spektor (ianspektor) commented Jan 5, 2026

Uh oh!

Ian Spektor (ianspektor) commented Jan 5, 2026

Uh oh!

ADITYAKUMARRAI2007 commented Jan 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Alon Nahmias (alonahmias) commented Jan 13, 2026

Uh oh!

ADITYAKUMARRAI2007 commented Jan 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ian Spektor (ianspektor) commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ian Spektor (ianspektor) commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ADITYAKUMARRAI2007 commented Jan 19, 2026

Uh oh!

Ian Spektor (ianspektor) commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Aaron Lim (aaron-lim-es) commented Jan 28, 2026

Uh oh!

Shoham Yamin (shohamyamin) commented Feb 1, 2026

Uh oh!

Mario (mpapathimiu) commented Mar 13, 2026

Uh oh!

Aravind Manoj (aravind-manoj) commented May 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

ADITYAKUMARRAI2007 commented Dec 31, 2025 •

edited

Loading

Ian Spektor (ianspektor) commented Jan 16, 2026 •

edited

Loading

Ian Spektor (ianspektor) commented Jan 19, 2026 •

edited

Loading

Ian Spektor (ianspektor) commented Jan 20, 2026 •

edited

Loading