@google/genai@1.26.0 breaks Vertex AI ADC authentication with CREDENTIALS_MISSING 401

TL;DR

Verified resolution: upgrade to @google/genai@1.27.0: collaborator yyyu-google released 1.27.0 with the fix, and four separate users confirmed on the thread that 1.27.0 resolves it (including default service account authentication on Cloud Run functions). Temporary workaround if you cannot upgrade immediately: pin to 1.23.0, 1.24.0, or 1.25.0, which multiple reporters confirmed restore working ADC auth.

When to use

You are seeing this: After upgrading @google/genai from 1.23.0 to 1.26.0, Vertex AI authentication with Application Default Credentials (ADC) failed with a 401 UNAUTHENTICATED error indicating CREDENTIALSMISSING, even though the same ADC credentials worked with 1.23.0. Use this skill when you run into "@google/genai@1.26.0 breaks Vertex AI ADC authentication with CREDENTIALSMISSING 401".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 1.23.0, 1.26.0, 1.23.0 1.24.0, 1.25.0, google-auth-library 10.4.1, googlegenai 1.27.0. If you are on something much newer or older, the details may have shifted.

What's going on

After upgrading @google/genai from 1.23.0 to 1.26.0, Vertex AI authentication with Application Default Credentials (ADC) failed with a 401 UNAUTHENTICATED error indicating CREDENTIALS_MISSING, even though the same ADC credentials worked with 1.23.0. Reproducible on Cloud Run and locally with ADC. Multiple users confirmed downgrading to 1.23.0, 1.24.0, or 1.25.0 restored authentication, confirming a regression in 1.26.0 (which pulled in google-auth-library@10.4.1).

The verified fix

This was a regression in @google/genai@1.26.0 breaking Vertex AI ADC authentication. Verified resolution: upgrade to @google/genai@1.27.0: collaborator yyyu-google released 1.27.0 with the fix, and four separate users confirmed on the thread that 1.27.0 resolves it (including default service account authentication on Cloud Run functions). Temporary workaround if you cannot upgrade immediately: pin to 1.23.0, 1.24.0, or 1.25.0, which multiple reporters confirmed restore working ADC auth. Source: https://github.com/googleapis/js-genai/issues/1038

How to use this

Take the question above and check if it matches what you're seeing. If it does, work through the verified fix step by step. Start with the cause described first, because that's what tells you the fix applies to your setup, then apply the changes in the order given. Verify by re-running whatever failed before, and expect the same behavior the thread author reported.

Someone asked: After upgrading @google/genai from 1.23.0 to 1.26.0, Vertex AI authentication with Application Default Credentials (ADC) failed with a 401 UNAUTHENTICATED error indicating CREDENTIALSMISSING, even though the same ADC credentials worked with 1.23.0. Reproducible on Cloud Run and locally with ADC. Multiple users confirmed downgrading to 1.23.0, 1.24.0, or 1.25.0 restored authentication, confirming a regression in 1.26.0 (which pulled in google-auth-library@10.4.1). The verified answer: This was a regression in @google/genai@1.26.0 breaking Vertex AI ADC authentication. Verified resolution: upgrade to @google/genai@1.27.0: collaborator yyyu-google released 1.27.0 with the fix, and four separate users confirmed on the thread that 1.27.0 resolves it (including default service account authentication on Cloud Run functions). Temporary workaround if you cannot upgrade immediately: pin to 1.23.0, 1.24.0, or 1.25.0, which multiple reporters confirmed restore working ADC auth. Source: https://github.com/googleapis/js-genai/issues/1038 Discussion and confirmation live at https://vectle.com/threads/thrdx9EP9_aIMMgaLR8Kl-OBw