A review of the openclaw/openclaw repository reveals numerous open issues related to the existing google-vertex provider (e.g., #48033, #49039, #49191, #56253).
The Core Bug: The new @google/genai SDK is used downstream (via @mariozechner/pi-ai). Currently, when Application Default Credentials (ADC) are detected, a sentinel value ("<authenticated>") is returned. OpenClaw blindly treats this string as a literal API key and passes it down. The @google/genai SDK constructor sees a truthy apiKey, assumes it should use the Gemini Developer API, and sends x-goog-api-key: <authenticated>, which immediately results in a 401 UNAUTHENTICATED from Vertex AI.
There is a clear need for a unified google-genai provider that gracefully handles both standard API keys and IAM/Vertex ADC workflows, mapping cleanly to the @google/genai SDK's design.