For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Run agentgateway on Google Cloud and reach Vertex AI with a service account instead of an API key.

Run agentgateway on Cloud Run or GKE, and reach Vertex AI with the service account that Google Cloud already attaches to the workload. No API key goes into your configuration file.

Authenticate with a service account

On Cloud Run and GKE, Google Cloud supplies credentials to the workload through its service account, which agentgateway reads with Application Default Credentials (ADC). ADC is the default for the vertex provider, so auth.gcp only makes that choice explicit.

# yaml-language-server: $schema=https://agentgateway.dev/schema/config

llm:
  models:
  - name: gemini-2.5-flash
    provider: vertex
    params:
      model: google/gemini-2.5-flash
      vertexProject: my-project-id
      vertexRegion: us-central1
    auth:
      gcp:
        type: accessToken

Review the following table to understand this configuration.

For the full list of Vertex AI settings, see Vertex AI. For direct Gemini API access with an API key instead, see Google Gemini.

Run on Cloud Run

Run agentgateway as a serverless container. Cloud Run gives the container an identity through its service account and can mount your configuration file from Secret Manager.

gcloud secrets create agentgateway-config --data-file=config.yaml

gcloud run deploy agentgateway \
  --image cr.agentgateway.dev/agentgateway:latest-dev \
  --port 4000 \
  --service-account [email protected] \
  --set-secrets /config/config.yaml=agentgateway-config:latest \
  --args="-f,/config/config.yaml" \
  --no-allow-unauthenticated

Note the following details.

• Port 4000 carries LLM traffic. When your configuration file defines no gateway, the implied default gateway serves LLM traffic on port 4000 and MCP traffic on port 3000. Set --port to the port that carries the traffic you route. For more information, see Configuration modes.
• The service account is the credential. Because auth.gcp uses ADC, --service-account is what lets agentgateway call Vertex AI. No API key is needed in the deploy command or in the configuration file.
• A secret mount is read-only. Set config.storage.mode to readOnly so that writes from the UI fail with a clear message instead of a filesystem error. For more information, see Configuration storage.

Run on GKE

GKE is an ordinary Kubernetes distribution as far as agentgateway is concerned. Two options are available.

• Run standalone agentgateway as a Deployment with the Helm chart. Bind the Kubernetes service account to a Google service account with Workload Identity Federation, and the same auth.gcp configuration applies.
• Run the Kubernetes control plane, which manages agentgateway proxies from Kubernetes custom resources and the Kubernetes Gateway API.

IAM roles

Create a service account and grant it the roles that agentgateway needs.

# Create the service account
gcloud iam service-accounts create agentgateway \
  --display-name "agentgateway"

# Grant Vertex AI access
gcloud projects add-iam-policy-binding my-project \
  --member "serviceAccount:[email protected]" \
  --role "roles/aiplatform.user"

# Grant access to the configuration secret
gcloud secrets add-iam-policy-binding agentgateway-config \
  --member "serviceAccount:[email protected]" \
  --role "roles/secretmanager.secretAccessor"

Google Cloud services

Next steps

• Vertex AI for the full provider reference.
• Set up the UI to serve the web interface on a gateway.
• Choose where configuration is stored before you mount a read-only secret.