[artickc]

Problem

The Vertex executor only supported Service Account JSON credentials. parseSAFromApiKey runs JSON.parse(apiKey) and throws for any non‑JSON string, so every Vertex AI Express‑mode API key failed with:

[vertex/<model>] [502]: Vertex AI requires a valid Service Account JSON as the API key

This blocked Express‑key users on both chat completions and media/image generation (which route through the Vertex executor with modalities).

Fix

• Add looksLikeServiceAccountJson() (a JSON object → Service Account path) and isExpressApiKey() (an opaque non‑JSON, non‑empty string → Express path).
• execute() only mints a JWT/OAuth token when the credential is Service Account JSON; an Express key is used as‑is.
• buildUrl() Express branch targets the project‑less v1 publisher endpoint with the key passed as the ?key= query parameter — the documented Express contract:
  • non‑stream: https://aiplatform.googleapis.com/v1/publishers/google/models/{model}:generateContent?key=...
  • stream: ...:streamGenerateContent?alt=sse&key=...
• buildHeaders() does not add an Authorization header for Express keys (the key is in the query string).
• validateProviderApiKey accepts any non‑empty Express key for vertex / vertex-partner (there is no JWT to mint; the live call validates it).

The Service Account JSON path (JWT → oauth2.googleapis.com/token → project‑scoped endpoint + Authorization: Bearer) is unchanged.

Tests

Per the repository style guide (tests required for open-sse/ and src/ changes):

• New tests/unit/vertex-express-apikey.test.ts covers isExpressApiKey/looksLikeServiceAccountJson, the Express buildUrl (stream + non‑stream, URL‑encoding/trim), accessToken‑takes‑SA‑path precedence, buildHeaders omitting auth, and an end‑to‑end execute() that calls the publisher endpoint directly with no OAuth token exchange.
• Updated t29-vertex-sa-json-executor.test.ts and executor-vertex-extended.test.ts where they previously asserted a non‑JSON key throws (a non‑JSON key is now a valid Express key); the "incomplete Service Account JSON still fails clearly" behavior is retained.

All 22 Vertex tests pass locally:

node --import tsx --test tests/unit/vertex-express-apikey.test.ts \
  tests/unit/t29-vertex-sa-json-executor.test.ts \
  tests/unit/executor-vertex-extended.test.ts
# pass 22, fail 0

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[kilo-code-bot]

SUGGESTION: Comments say Express keys use x-goog-api-key, but implementation uses ?key=.

The top comment and the execute() comment describe Express auth as x-goog-api-key, while buildUrl() puts the key in the query string and buildHeaders() intentionally omits that header. Update the comments so future maintainers do not reintroduce the header or assume the wrong transport.

[kilo-code-bot]

WARNING: Express API key is placed in the URL query string.

BaseExecutor logs full request URLs on timeout/retry/401 paths and returns result.url to chatCore, which passes it to logTargetRequest without URL redaction. If ?key= is used, a valid API key can be persisted in logs or pipeline payloads. Add URL redaction for this provider, avoid query-string credentials, or otherwise ensure the logging pipeline strips key before storage.

[kilo-code-bot]

WARNING: Partner Express branch returns an endpoint without the requested model or stream mode.

For partner models, this returns /v1/publishers/openapi/chat/completions?key=... regardless of model and stream. If Vertex Express keys do not support partner models, fail before building the URL; if they do, include the model and stream-specific operation so future callers do not accidentally send unsupported requests.

[kilo-code-bot]

WARNING: Provider validation accepts any non-empty non-JSON string as a valid Vertex key.

isExpressApiKey is intentionally broad, so validateProviderApiKey now returns success for values like not-json, JSON arrays, or random strings without a live call. The Settings validation UI can report a broken key as valid and users only discover the problem during chat/media requests. The same issue applies to the vertex-partner branch below.

[kilo-code-bot]

Code Review Summary

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	1

Issue Details (click to expand)

CRITICAL

File	Line	Issue

WARNING

File	Line	Issue
open-sse/executors/vertex.ts	157	Express API key is placed in the URL query string; BaseExecutor and chatCore log/return full URLs without URL redaction, so valid keys may be persisted in logs or pipeline payloads.
open-sse/executors/vertex.ts	161	Partner Express branch returns /v1/publishers/openapi/chat/completions?key=... without the requested model or stream mode. If partner models are unsupported by Express keys, fail before building the URL; otherwise include model/stream-specific routing.
src/lib/providers/validation.ts	3961	Provider validation accepts any non-empty non-JSON string as a valid Vertex key without a live call, so invalid keys can be reported as valid. The same issue applies to the vertex-partner branch below.

SUGGESTION

File	Line	Issue
open-sse/executors/vertex.ts	28	Comments say Express keys use x-goog-api-key, but the implementation uses ?key= and omits that header.

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
src/shared/constants/providers.ts	1166	vertex auth hint still says "Service Account JSON or OAuth access_token" and does not mention Express API keys.
open-sse/executors/vertex.ts	123	isPartnerModel() does not cover all current vertex-partner model IDs such as claude-opus-4-7, claude-sonnet-4-6, Qwen3.6-35B-A3B, and GLM-5.1-FP8.

Files Reviewed (5 files)

• open-sse/executors/vertex.ts - 3 issues
• src/lib/providers/validation.ts - 1 issue
• tests/unit/vertex-express-apikey.test.ts - 0 issues
• tests/unit/executor-vertex-extended.test.ts - 0 issues
• tests/unit/t29-vertex-sa-json-executor.test.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by nex-n2-pro:free · 2,556,869 tokens}

[diegosouzapw]

Merged into release/v3.8.23 ✅ — thanks @artickc! Clean support for Vertex AI Express-mode API keys (project-less ?key= endpoint) alongside Service Account JSON, with an excellent test suite covering the URL routing, header handling, and the execute path. Ships in the next release.