Skip to content
Kindgi

Connect Gemini on Vertex AI

View as Markdown

This guide connects Gemini on Vertex AI to your agents, with your Google Cloud credentials instead of an API key.

The gemini preset registers Gemini 3.8 Flash and Gemini 3.5 Flash Lite on Google Cloud's Vertex AI. It takes no API key: calls use your Google Cloud credentials, and Vertex AI runs and bills them in a project you name.

Before you start

Section titled “Before you start”
  • A pack with kindgi dev running, from Kindgi 0.1's CLI.
  • The gcloud CLI.
  • A Google Cloud project with the Vertex AI API turned on, and an account with access to Vertex AI in it.

1. Log in to Google Cloud

Section titled “1. Log in to Google Cloud”

The runtime calls Vertex AI with your credentials. Log in once:

Terminal window
gcloud auth application-default login

It opens a browser to sign in. That writes your Application Default Credentials to ~/.config/gcloud/application_default_credentials.json. The account needs access to Vertex AI in the project.

kindgi dev gives the runtime Google credentials only when you say which, with KINDGI_DEV_GOOGLE_CREDENTIALS. Set it in the pack's .env, in .env.local for a path that's only yours, or in the shell:

.env
KINDGI_DEV_GOOGLE_CREDENTIALS=adc

adc is your gcloud login. An absolute path names another credentials file, such as a service-account key. off, the default, gives none. kindgi dev mounts the file read-only, and names it and whose it is when it starts:

✓ Google credentials: /Users/you/.config/gcloud/application_default_credentials.json (your gcloud application-default login, a user account), mounted read-only for Vertex AI

Without the setting, a gemini provider has no credentials and its calls fail. kindgi dev says so when it starts, and kindgi doctor says the same:

⚠ Provider gemini (Vertex AI) has no Google credentials: set KINDGI_DEV_GOOGLE_CREDENTIALS=adc (or a credentials file), in the pack's .env or the shell, and restart kindgi dev.

A GOOGLE_APPLICATION_CREDENTIALS in your shell isn't used unless you name it: KINDGI_DEV_GOOGLE_CREDENTIALS=$GOOGLE_APPLICATION_CREDENTIALS.

2. Register the preset

Section titled “2. Register the preset”

Register the preset's models with the runtime:

Terminal window
pnpm exec kindgi providers register --preset=gemini --project=<gcp-project>

It prints ✓ Registered gemini: with the models it registered. --preset=gemini names the preset. --project is the Google Cloud project Vertex AI runs and bills in, and <gcp-project> is its id. The preset refuses to register without it:

Error: preset "gemini" needs --project=<…> (The Google Cloud project Vertex AI bills and authorises against.)
Excerpt

--models registers only some of the models:

Terminal window
pnpm exec kindgi providers register --preset=gemini --project=<gcp-project> --models=gemini-3.8-flash
{
  "providerId": "gemini"
}
✓ Registered gemini: gemini-3.8-flash (default)

The preset's models answer with up to 65,536 tokens, thinking included. --max-output-tokens=<n> registers them with another limit, <n> tokens.

To have kindgi dev register it on every boot, ask your coding agent to declare it in the pack's config instead. Kindgi's skills in your pack tell it how (How it knows Kindgi). It goes there as { preset: 'gemini', project: '<gcp-project>' } in kindgi.config.ts's providers, or a [[tool.kindgi.providers]] table with preset = "gemini" and project = "<gcp-project>" in pyproject.toml. Declare them in your pack's config shows how.

What it registers

Section titled “What it registers”

Get the provider by its id to see what it registered:

Terminal window
pnpm exec kindgi providers get gemini

It prints the provider as JSON. Its id is gemini and its region global, where Vertex AI serves Gemini 3.8 Flash, which isn't served from us-central1. Both models list tool-use, structured-output and long-context:

Model Context window Per 1K input / output tokens
gemini-3.8-flash (default) 1,048,576 $0.00075 / $0.00375
gemini-3.5-flash-lite 1,048,576 $0.0003 / $0.0025
  • Gemini 3.8 Flash thinks before it answers, and Vertex AI bills the thinking as output tokens. Kindgi counts them in the turn's output tokens and its cost: in a check on 2026-10-07, a one-word answer used 94 output tokens, 93 of them thinking. Gemini 3.5 Flash Lite answered without thinking.
  • Its price is Google's launch price, through 2026-12-31. From 2027-01-01 Google charges $0.0015 / $0.0075 per 1K tokens, and a turn's totalCostUsd still uses the price the provider was registered with.

To send an agent to Gemini when other providers are registered too, set preferredProvider: 'gemini', or preferred_provider="gemini" in Python. Or require it, as Choose the model an agent uses shows.

On a runtime that keeps tenants apart

Section titled “On a runtime that keeps tenants apart”

A runtime with KINDGI_TENANT_HOST_ACCESS=isolated doesn't lend its own Google credentials to what a tenant registers. There, put a service-account key (its JSON) in a secret and name it in the provider's secret_ref. Without one, the registration is refused, naming secret_ref:

Error [invalid-request]: Provider "gemini" doesn't fit adapter @kindgi/adapter-model-gemini: uses Vertex AI without secret_ref, which signs in with the server's own Google credentials (Application Default Credentials); this deployment doesn't let tenant configuration use them (KINDGI_TENANT_HOST_ACCESS). Name a service-account key in secret_ref.
  ✗ /secret_ref: uses Vertex AI without secret_ref, which signs in with the server's own Google credentials (Application Default Credentials); this deployment doesn't let tenant configuration use them (KINDGI_TENANT_HOST_ACCESS). Name a service-account key in secret_ref.

If you registered Gemini 2.5

Section titled “If you registered Gemini 2.5”

An earlier preset registered gemini-2.5-pro and gemini-2.5-flash. Vertex AI retires both on 2026-10-20. After that, a turn routed to them fails. Update the CLI, then:

  • A provider you registered with kindgi providers register: unregister it and register the preset again. A registration can't be edited:

    Terminal window
    pnpm exec kindgi providers unregister gemini
    pnpm exec kindgi providers register --preset=gemini --project=<gcp-project>

    unregister prints its answer as JSON, and register prints its ✓ Registered gemini: line.

  • A provider the pack's config declares: restart kindgi dev. It registers the preset's new models in place of the old ones:

      Providers from kindgi.config.ts:
        ✓ gemini: registered again (changed in kindgi.config.ts)

    A declaration whose models names a Gemini 2.5 model stops kindgi dev from starting, as --models does with kindgi providers register. Name one of the new models instead:

    kindgi dev: `providers` in kindgi.config.ts: entry 1: preset "gemini" has no model gemini-2.5-flash — it has gemini-3.8-flash, gemini-3.5-flash-lite

An agent that prefers or requires a Gemini 2.5 model needs a new version that names one of these: a preference falls to the next model in line, and a requirement matches nothing.

From a deployed runtime

Section titled “From a deployed runtime”

A deployed runtime has no login of yours: it calls Vertex AI as its own service account. On Cloud Run, that's the service's account. That account needs roles/aiplatform.user in the project, and the project needs the Vertex AI API turned on. Without the role, every model call fails with Permission 'aiplatform.endpoints.predict' denied. Deploy on Google Cloud Run sets this up.

Next

Section titled “Next”