How to get authorization token for Google's Vertex AI service?

Question

I am trying to call Google's Vertex AI API via REST to something like:

https://us-central1-aiplatform.googleapis.com/v1/projects/...

I am having trouble with figuring out where to get the "access token":

-X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \

I was able to generate a short-term OAUth one from Google CLI, but I want to generate a long-term one. I have tried the following, all of which returns a 401 error:

• API Key

• Service Account

I just need this for testing purposes. Is there a way for me to do this easily?

Using Google CLI, but it was a short-term solution. The token expired after 30 minutes.

Answer 1

You can only do this via the REST API (see documentation) with the following requirement

By default, the maximum token lifetime is 1 hour (3,600 seconds). To extend the maximum lifetime for these tokens to 12 hours (43,200 seconds), add the service account to an organization policy that includes the constraints/iam.allowServiceAccountCredentialLifetimeExtension list constraint.

To use the REST API, you execute a POST method to

https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/PRIV_SA:generateAccessToken

with a body

{
  "scope": [
    "https://www.googleapis.com/auth/cloud-platform"
  ],
  "lifetime": "LIFETIME"
}

where

LIFETIME: The amount of time until the access token expires, in seconds. For example, 300s

PRIV_SA: The email address of the privilege-bearing service account for which the short-lived token is created.

Your current method is via gcloud CLI. According to documentation,

The Google Cloud CLI does not support setting a lifetime for the token

This means you're limited to the default time limit which is designed to be short (the access token is referred to as short-lived credentials)

Answer 2

update: now you can use google makersuite to generate a simple api key see step-by-step to generate API key for vertexAI in makersuite, but currently is on a closed beta. then just call the vertex AI api with &key=thatKey

without makersuite, because you are on a non-GCE server, you need to impersonate a service account

You will need these configuration steps so the instructions in that link work:

1. Install the Google Cloud SDK
2. Create a service account: If you haven't already done so, and give necessary permissions.
3. Obtain a service account key file.
4. Set up authentication using "gcloud auth activate-service-account --key-file=[PATH_TO_KEY_FILE]
5. impersonate the service account by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of the service account key file. This step is essential for API calls to be associated with the service account.
6. Generate (short lived) access tokens and regenerate as needed since you now have the key file installed.

Answer 3

I finally was able to call Palm (bison) from NodeJS and normal service account. See code:

import { JWT } from "google-auth-library";

const API_ENDPOINT = "us-central1-aiplatform.googleapis.com";
const URL = `https://${API_ENDPOINT}/v1/projects/${process.env.GOOGLE_KEY}/locations/us-central1/publishers/google/models/chat-bison@001:predict`;

const getIdToken = async () => {
    const client = new JWT({
        keyFile: "./google.json",
        scopes: ["https://www.googleapis.com/auth/cloud-platform"],
    });
    const idToken = await client.authorize();
    return idToken.access_token;
};

export const getTextPalm = async (prompt, temperature) => {
    const headers = {
        Authorization: `Bearer ` + (await getIdToken()),
        "Content-Type": "application/json",
    };

    const data = {
        instances: [
            {
                context: "",
                examples: [],
                messages: [
                    {
                        author: "user",
                        content: prompt,
                    },
                ],
            },
        ],
        parameters: {
            temperature: temperature || 0.5,
            maxOutputTokens: 1024,
            topP: 0.8,
            topK: 40,
        },
    };

    const response = await fetch(URL, {
        method: "POST",
        headers,
        body: JSON.stringify(data),
    });

    if (!response.ok) {
        console.error(response.statusText);
        throw new Error("Request failed " + response.statusText);
    }

    const result = await response.json();
    return result.predictions[0].candidates[0].content;
};

I also had to add some permissions to service account, like this: