Google Cloud Agent Platform (Vertex)

Google Cloud’s Agent Platform was called Vertex until 2026. Its full name is now Gemini Enterprise Agent Platform, and its API is still aiplatform.googleapis.com.

An Agent Platform connection sends the models you choose through your own Google Cloud project, so Google bills your project instead of Amp. It serves Claude models through Model Garden and Gemini models through the OpenAI-compatible endpoint.

Amp authenticates with Workload Identity Federation. You add Amp to a workload identity pool in your project and grant it the Vertex AI User role, and Amp stores no key or secret.

Set Up a Connection

In Amp, open personal model routing or workspace model routing and add a Google Cloud Agent Platform connection. You will authenticate with Workload Identity Federation, and the form walks you through getting the credentials by showing you this script:

Sign in to see your own AMP_ISSUER and AMP_SUBJECT values in the script. 
# The Google Cloud project that will be billed for inference.
export PROJECT_ID=my-project
export PROJECT_NUMBER=$(gcloud projects describe "$PROJECT_ID" --format "value(projectNumber)")

# The Amp user or workspace that will use this connection.
export AMP_ISSUER=AMP_ISSUER
export AMP_SUBJECT=AMP_SUBJECT

gcloud services enable aiplatform.googleapis.com iam.googleapis.com \
  cloudresourcemanager.googleapis.com sts.googleapis.com --project "$PROJECT_ID"

gcloud iam workload-identity-pools create amp-inference \
  --project "$PROJECT_ID" --location global --display-name "Amp"

gcloud iam workload-identity-pools providers create-oidc amp-inference \
  --project "$PROJECT_ID" --location global --workload-identity-pool amp-inference \
  --issuer-uri "$AMP_ISSUER" \
  --attribute-mapping "google.subject=assertion.sub" \
  --attribute-condition "assertion.sub == '$AMP_SUBJECT'"

gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --role roles/aiplatform.user \
  --member "principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/amp-inference/subject/$AMP_SUBJECT"

gcloud iam workload-identity-pools providers describe amp-inference \
  --project "$PROJECT_ID" --location global --workload-identity-pool amp-inference \
  --format "value(name)"

The last command prints the provider resource name. Paste it into the Workload Identity Provider field, select which models should use the connection, and save.

Gemini models work as soon as the API is enabled. Each Claude model must be enabled once per project in Model Garden by a project Owner or a person with the Consumer Procurement Entitlement Manager role. A 404 error that says “your project does not have access to it” means the model is not enabled yet.

Use the Check Access button to confirm that Google accepts Amp’s identity. Amp bills the project that owns the pool and uses the global location unless you change them under Custom Project and Custom Location.

You can also add the connection from the CLI:

amp config model-providers setup-guide google-cloud-agent-platform --workspace

# The Google Cloud project that owns the workload identity pool.
export PROJECT_ID=my-project
export PROJECT_NUMBER=$(gcloud projects describe "$PROJECT_ID" --format "value(projectNumber)")

amp config model-providers add-router google-cloud-agent-platform --workspace \
  --workload-identity-provider "projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/amp-inference/providers/amp-inference" \
  --model-mapping anthropic/claude-opus-4-6

To confirm that a model is served through your connection, run a small inference and inspect the modelRouting field of the JSON result:

amp config model-providers check-access --provider-model anthropic/claude-opus-4-6 \
  --thread https://ampcode.com/threads/T-...

This sends a real request with a short prompt, so it may incur a small cost on your Google Cloud project (or a few Amp credits if Amp serves the model instead). Pass any thread you own with --thread, or set AMP_THREAD_ID; the thread is only used to associate the cost, and its transcript is not changed.

Credentials Amp Does Not Accept

Workload Identity Federation is the only supported authentication method. Amp does not accept these credentials, and does not plan to:

  • Service account JSON keys. These are long-lived secrets, and Google blocks key creation by default in organizations created since May 2024.
  • API keys, including Express Mode keys. These keys only reach Gemini through the generateContent API and cannot call Claude.
  • Tokens from gcloud auth print-access-token. These tokens expire after one hour, and Amp cannot refresh them.
  • Google account sign-in (OAuth). This would tie the connection to one person’s Google account instead of a project-level trust.

For more, see Google’s Workload Identity Federation documentation.