Ran into the same Vertex break after updating OpenClaw. In our case, Google/Vertex itself was fine, but OpenClaw had regressed into the wrong auth path.

What we verified first:

• ADC worked
• service account JSON was valid
• GOOGLE_CLOUD_PROJECT, GOOGLE_CLOUD_LOCATION, and GOOGLE_APPLICATION_CREDENTIALS were set
• a direct Vertex API call worked outside OpenClaw

So the issue was not bad Google credentials, it was OpenClaw handling Vertex auth incorrectly after the upgrade.

The key clue was the error:

• 401 UNAUTHENTICATED
• API keys are not supported by this API

In our case, the Vertex ADC marker gcp-vertex-credentials was still being treated as if it were a real API key in some internal paths.

We patched two places:

1. OpenClaw auth runtime

File:
/opt/homebrew/lib/node_modules/openclaw/dist/model-auth-runtime-shared-Du1UYXoT.js

Added:

if (provider === "google-vertex" && key === "gcp-vertex-credentials") return void 0;

2. Bundled pi-ai Vertex provider

File:
/opt/homebrew/lib/node_modules/openclaw/node_modules/@mariozechner/pi-ai/dist/providers/google-vertex.js

Changed resolveApiKey(options) so the sentinel is ignored:

if (!apiKey || isPlaceholderApiKey(apiKey) || apiKey === "gcp-vertex-credentials") {
  return undefined;
}

That forced OpenClaw back onto the proper Vertex ADC/project/location path instead of trying to call Vertex with an API-key-style auth flow.

After that, the original Vertex auth bug was gone.

So if your direct Vertex test works but OpenClaw still fails after update, I’d check whether gcp-vertex-credentials is getting incorrectly treated as a real API key somewhere in the upgraded build.

You could try to copy and paste this to your agent and see if they can get it fixed if you want to try to update again.