feat: Add skipAuth option for custom endpoints without Google Cloud c…

[what-is-thy-bidding]

Why

When using custom endpoints (proxy servers) that implement the Vertex AI API format, users currently MUST provide Google Cloud credentials even though these credentials are never used for actual authentication. The custom endpoints (proxy servers) handle their own authentication (e.g., via Bearer tokens).

The credentials are stored on that proxy server and not on the client's machine locally.

This creates unnecessary friction:

• Users must obtain a real GCP service account JSON file
• Must set GOOGLE_APPLICATION_CREDENTIALS environment variable
• Must provide valid project/location values
• All of this just to initialize the SDK, even though the custom endpoint ignores these credentials entirely

Solution

Added a new `skipAuth` option to `HttpOptions` that allows users to:

• Skip Google Cloud credential validation and loading
• Skip project/location requirement checks
• Bypass GoogleAuth initialization entirely
• Skip prepending `projects/{project}/locations/{location}/` to URL paths

When `skipAuth: true`:

1. node_client.ts skips reading env vars and validation
2. _node_auth.ts skips GoogleAuth initialization
3. No auth headers are added (custom endpoint handles auth via httpOptions.headers)
4. _api_client.ts skips prepending `projects/{project}/locations/{location}/` to request paths

Why skip prependProjectLocation?

Normal Vertex AI URLs look like:
https://us-central1-aiplatform.googleapis.com/v1/projects/my-project/locations/us-central1/publishers/google/models/gemini:generateContent

Custom endpoint URLs should look like:
https://custom-endpoint.com/v1/publishers/google/models/gemini:generateContent

When `skipAuth` is set:

• Custom endpoints don't expect the `projects/{project}/locations/{location}/` path prefix
• With `skipAuth`, we likely don't have valid project/location values anyway (they'd be `undefined`)
• The custom endpoint handles its own routing and doesn't need GCP resource paths

Changes

• src/types.ts: Added `skipAuth?: boolean` to HttpOptions interface
• src/node/_node_auth.ts: Skip GoogleAuth init when skipAuth is true
• src/_api_client.ts: Skip project/location path prepending when skipAuth is true
• src/node/node_client.ts: Conditional env var loading based on skipAuth

Example Usage

Before (requires REAL Google Cloud credentials):

// Step 1: Must have a real GCP service account JSON file
// Step 2: Set environment variable
process.env.GOOGLE_APPLICATION_CREDENTIALS = './service_account.json';

// Step 3: Initialize SDK (GoogleAuth tries to load credentials)
const ai = new GoogleGenAI({
  vertexai: true,
  project: 'my-gcp-project',      // Required even though never used
  location: 'us-central1',         // Required even though never used
  httpOptions: {
    baseUrl: 'https://custom-endpoint.example.com/v1/',
    headers: { 'Authorization': 'Bearer MY_CUSTOM_TOKEN' },
  },
});

// Without GOOGLE_APPLICATION_CREDENTIALS: Error - Could not load credentials
// URL would be: .../projects/my-gcp-project/locations/us-central1/publishers/... (won't work, because the location and project name isn't stored on the client's machine but on the proxy-server)

After (no Google Cloud setup needed):

// No service account file needed!
// No GOOGLE_APPLICATION_CREDENTIALS needed!
// No project/location needed!

const ai = new GoogleGenAI({
  vertexai: true,
  httpOptions: {
    baseUrl: 'https://custom-endpoint-proxy-server.com/v1/',
    headers: { 'Authorization': 'Bearer MY_CUSTOM_TOKEN' },
    skipAuth: true,  // Skip all Google Cloud authentication
  },
});

// URL will be: .../publishers/google/models/gemini:generateContent

This brings the TypeScript SDK in line with the Python SDK's behavior, where custom http_options automatically bypass Google Cloud authentication.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[what-is-thy-bidding]

The project name and the location shouldn't be available on the client's local machine when using a proxy server. Those details are stored in the proxy server

Hence shouldn't be prepended to the final url

[what-is-thy-bidding]

This will force skipAuth to ONLY be used when using a baseUrl set by the client and not the default base url set by the SDK

[what-is-thy-bidding]

@shmishra99 : is there an update on this feature request?