{"slug": "stop-your-keys-in-env-securely-auto-wire-vertex-ai-for-local-dev", "title": "Stop your Keys in .env: Securely Auto-Wire Vertex AI for Local Dev", "summary": "A developer detailed a method to securely auto-wire Google Cloud Vertex AI for local development by storing service account keys in the OS-native encrypted keyring instead of plaintext files. The approach uses secret-tool on Linux and security on macOS to keep credentials in memory, with a shell profile check to load them into the environment. The post also highlights common configuration traps, such as missing IAM role bindings and the need to explicitly set the VERTEX_SA_JSON environment variable when adding the backend.", "body_md": "Setting up GCP Vertex AI locally usually ends up with a `service-account.json`\n\nkey sitting in your home directory or a raw `export VERTEX_SA_JSON=$(cat ...)`\n\nshoved into your `.bashrc`\n\n.\n\nIt works, but it's sloppy. Files get accidentally committed to git repositories, keys rot on disk, and plaintext credentials just sit there waiting to be read by any local process.\n\nHere’s how to auto-wire Vertex AI into Contenox cleanly using your system’s native encrypted keyring (Linux or macOS), keeping credentials strictly in memory—along with the common configuration traps to avoid.\n\nFirst, spin up your service account and generate the JSON key via `gcloud`\n\n:\n\n```\n# 1. Create the service account\ngcloud iam service-accounts create vertex-runner \\\n  --description=\"Service account for Contenox Vertex AI\" \\\n  --display-name=\"Vertex Runner\" \\\n  --project=YOUR_PROJECT_ID\n\n# 2. Grant the Vertex AI User role (CRITICAL — without this every call 403s)\ngcloud projects add-iam-policy-binding YOUR_PROJECT_ID \\\n  --member=\"serviceAccount:vertex-runner@YOUR_PROJECT_ID.iam.gserviceaccount.com\" \\\n  --role=\"roles/aiplatform.user\"\n\n# 3. Generate and download the JSON key\ngcloud iam service-accounts keys create service-account.json \\\n  --iam-account=vertex-runner@YOUR_PROJECT_ID.iam.gserviceaccount.com\n```\n\nThe IAM Trap:Step 2 is easy to miss. Creating the account and key succeeds without it, but the key has zero permissions by default. If your requests throw`403 PERMISSION_DENIED`\n\n, this binding is usually what's missing.\n\nInstead of leaving `service-account.json`\n\nfloating around in your user directory, pipe it directly into your OS's native encrypted keyring and delete the file immediately.\n\n**For Linux (GNOME Keyring / KWallet):**\n\n```\n# Store key inside your system keyring\nsecret-tool store --label=\"Contenox Vertex Key\" service contenox key vertex_sa < service-account.json\n\n# Delete the local plaintext file\nrm service-account.json\n```\n\n**For macOS (Apple Keychain):**\n\n```\n# Store key inside macOS Keychain\nsecurity add-generic-password -a \"$USER\" -s \"contenox-vertex-sa\" -w \"$(cat service-account.json)\"\n\n# Delete the local plaintext file\nrm service-account.json\n```\n\nWhat about Windows?\n\nIf you are on Windows, usingWSL(Windows Subsystem for Linux) is absolutely the way to go—it gives you the standard Linux toolchain so you can just use`secret-tool`\n\nexactly as shown above. If youmustrun Contenox natively in PowerShell, you can achieve this same memory-only injection using the`Microsoft.PowerShell.SecretManagement`\n\nmodule, or by leaning on cross-platform CLI tools like 1Password (`op`\n\n) or Bitwarden (`bws`\n\n).\n\nAdd a non-blocking check to the end of your shell profile (`~/.bashrc`\n\non Linux, `~/.zshrc`\n\non macOS). When your shell fires up, it decrypts the key straight into RAM:\n\n**Linux ( ~/.bashrc):**\n\n```\n# Auto-load Contenox Vertex SA Key into memory\nif secret-tool lookup service contenox key vertex_sa >/dev/null 2>&1; then\n    export VERTEX_SA_JSON=$(secret-tool lookup service contenox key vertex_sa)\nfi\n```\n\n**macOS ( ~/.zshrc or ~/.bashrc):**\n\n```\n# Auto-load Contenox Vertex SA Key into memory\nif security find-generic-password -a \"$USER\" -s \"contenox-vertex-sa\" >/dev/null 2>&1; then\n    export VERTEX_SA_JSON=$(security find-generic-password -a \"$USER\" -s \"contenox-vertex-sa\" -w)\nfi\n```\n\nReload your shell:\n\n```\nsource ~/.bashrc  # or source ~/.zshrc\n```\n\nNow add the backend to Contenox and explicitly point it to `VERTEX_SA_JSON`\n\n:\n\n```\ncontenox backend add vertex --type vertex-google \\\n  --url \"https://aiplatform.googleapis.com/v1/projects/YOUR_PROJECT_ID/locations/global\" \\\n  --api-key-env VERTEX_SA_JSON\n\ncontenox config set default-provider vertex-google\ncontenox config set default-model gemini-3.6-flash\n```\n\nThe Gotcha:Youmustpass`--api-key-env VERTEX_SA_JSON`\n\nwhen adding the backend. If you omit it, Contenox ignores your environment variable and falls back to standard`gcloud`\n\nApplication Default Credentials (ADC), causing provider auth rejections if ADC isn't logged in.\n\nTest it out:\n\n```\ncontenox chat \"say hi\"\n```\n\n`op run`\n\n), `bws`\n\n), or\n\nA Quick Side Note on Local Hygiene:While we're talking about Contenox here, this keyring injection approach makes sense foranylocal environment variable or credential, regardless of the harness, tool, or framework you're using. Whether it's a standalone CLI script, an agent harness, or custom tooling, keeping raw keys off your filesystem and out of plaintext`.env`\n\nfiles should be standard operating procedure across your entire local dev setup.\n\n**P.S.** If you've got unused GCP cloud credits sitting around in a project, this setup is a super convenient way to put them to work through Contenox instead of paying out-of-pocket for standard API endpoints!", "url": "https://wpnews.pro/news/stop-your-keys-in-env-securely-auto-wire-vertex-ai-for-local-dev", "canonical_source": "https://dev.to/js402/stop-your-keys-in-env-securely-auto-wire-vertex-ai-for-local-dev-2kbl", "published_at": "2026-08-25 08:02:10+00:00", "updated_at": "2026-08-25 08:13:44.546532+00:00", "lang": "en", "topics": ["developer-tools", "ai-infrastructure"], "entities": ["Google Cloud", "Vertex AI", "Contenox", "gcloud", "GNOME Keyring", "Apple Keychain", "WSL", "PowerShell"], "alternates": {"html": "https://wpnews.pro/news/stop-your-keys-in-env-securely-auto-wire-vertex-ai-for-local-dev", "markdown": "https://wpnews.pro/news/stop-your-keys-in-env-securely-auto-wire-vertex-ai-for-local-dev.md", "text": "https://wpnews.pro/news/stop-your-keys-in-env-securely-auto-wire-vertex-ai-for-local-dev.txt", "jsonld": "https://wpnews.pro/news/stop-your-keys-in-env-securely-auto-wire-vertex-ai-for-local-dev.jsonld"}}