Onboarding Google Vertex AI as a First-Class Provider in the WSO2 API Manager AI Gateway

[hisanhunais]

Problem

The AI Gateway ships built-in providers for OpenAI, Azure OpenAI, Mistral, Anthropic (direct), AWS Bedrock, and Gemini (Google AI Studio). It has no support for Google Vertex AI.

Vertex requires GCP service-account OAuth2 authentication using the JWT-bearer grant (urn:ietf:params:oauth:grant-type:jwt-bearer): a short-lived bearer token minted from a service-account key. The AI backend-security layer only supports static API keys (and OAuth2 client credentials/password grants), so there is currently no way to authenticate to Vertex. gcloud is not available on the gateway, so the token must be minted in-process.

Proposed Solution

Enable Google Vertex AI as a first-class provider, covering the capabilities below:

• GCP service-account authentication for AI backends — the gateway can authenticate to Vertex using a service-account credential, with no dependency on external CLI tooling.
• Vertex AI provider support for Gemini and Claude — users can create, secure, deploy, and consume Vertex-backed AI APIs through the standard AI-API flow, with token usage captured for throttling and analytics for both model families.
• Secure storage of the service-account credential at rest, consistent with how other backend credentials are protected.
• Transparent request handling — a client can call a Vertex-backed API without needing Vertex-specific knowledge; the gateway takes care of the provider-specific request/response conventions.
• Portal configuration — the new authentication option and credential entry are available in the Publisher and Admin portals.

Alternatives

No response

Version

4.6.0