[DOCS] Vertex AI docs do not mention X.509 certificate-based Workload Identity Federation authentication

Documentation Type

Missing documentation (feature not documented)

Documentation Location

https://code.claude.com/docs/en/google-vertex-ai

Section/Topic

"Sign in with Vertex AI" and "3. Configure GCP credentials"

Current Documentation

The docs currently say:

Choose how you authenticate to Google Cloud: Application Default Credentials from gcloud, a service account key file, or credentials already in your environment.

Later, the manual setup section says:

Claude Code uses standard Google Cloud authentication. For more information, see Google Cloud authentication documentation.

And the note under that section says:

When authenticating, Claude Code will automatically use the project ID from the ANTHROPIC_VERTEX_PROJECT_ID environment variable. To override this, set one of these environment variables: GCLOUD_PROJECT, GOOGLE_CLOUD_PROJECT, or GOOGLE_APPLICATION_CREDENTIALS.

What's Wrong or Missing?

Changelog v2.1.121 added this behavior:

Vertex AI: support X.509 certificate-based Workload Identity Federation (mTLS ADC)

The current Vertex AI docs describe gcloud-backed Application Default Credentials, service account key files, and generic "credentials already in your environment," but they do not explicitly document that Claude Code now supports Google Cloud's X.509 certificate-based Workload Identity Federation / mTLS ADC flow.

That leaves enterprise users without clear guidance on whether certificate-based federation is a supported authentication path for Vertex AI, how it relates to ADC, and whether they can use it instead of downloadable service account keys.

Suggested Improvement

Update the Vertex AI authentication docs to explicitly list X.509 certificate-based Workload Identity Federation (mTLS ADC) as a supported Google Cloud authentication option.

Suggested additions:

• In the wizard section, expand the authentication options list to mention certificate-based Workload Identity Federation / mTLS ADC alongside gcloud ADC and service account key files.
• In "Configure GCP credentials," add a short note that Claude Code supports ADC established through X.509 certificate-based federation, so organizations can use certificate-backed workload identity instead of distributing service account keys.
• Link to the relevant Google Cloud authentication documentation for setting up certificate-based federation, since Claude Code relies on standard Google Cloud auth.

Impact

Medium - Makes feature difficult to understand

Additional Context

Affected Pages:

| Page | Context |
|------|---------|
| https://code.claude.com/docs/en/google-vertex-ai | Vertex AI sign-in flow, supported authentication methods, and manual credential setup |

Total scope: 1 page affected

Source: Changelog v2.1.121

Exact changelog entry: Vertex AI: support X.509 certificate-based Workload Identity Federation (mTLS ADC)