# How to Use LangExtract with Google Vertex AI Authentication: Enterprise Deployment Guide

> Securely deploy LangExtract with Google Vertex AI authentication. Set vertexai=True for IAM security, managed quotas, and VPC networking. Learn how to integrate now.

- Repository: [Google/langextract](https://github.com/google/langextract)
- Tags: how-to-guide
- Published: 2026-02-16

---

**LangExtract supports Google Vertex AI authentication by setting `vertexai=True` in the `language_model_params` dictionary alongside your GCP `project` and `location`, enabling IAM-based security, managed quotas, and VPC-restricted networking.**

LangExtract is an open-source structured extraction library maintained by Google that leverages Gemini models to parse unstructured text into structured data. While the default configuration uses direct API keys, production deployments often require **LangExtract with Google Vertex AI authentication** to integrate with Google Cloud IAM controls, leverage project-specific quotas, and operate within private networking environments.

## Architecture Overview

LangExtract implements Vertex AI support through a provider-based architecture that switches authentication modes based on configuration parameters:

| Component | Role | Source Location |
|-----------|------|-----------------|
| **`GeminiLanguageModel`** | Provider class that accepts `vertexai`, `project`, `location`, and optional `credentials` parameters to construct a `genai.Client` targeting Vertex AI endpoints. | [`langextract/providers/gemini.py`](https://github.com/google/langextract/blob/main/langextract/providers/gemini.py) |
| **`ModelConfig`** | Factory configuration parser that extracts `language_model_params` and forwards Vertex AI settings to the provider constructor. | [`langextract/factory.py`](https://github.com/google/langextract/blob/main/langextract/factory.py) |
| **`gemini_batch`** | Batch processing helper that validates Vertex AI client configuration via `_is_vertexai_client()` before submitting jobs to the Vertex AI Batch API. | [`langextract/providers/gemini_batch.py`](https://github.com/google/langextract/blob/main/langextract/providers/gemini_batch.py) |

When `vertexai=True` is specified, `GeminiLanguageModel.__init__` instantiates the client as follows:

```python
self._client = genai.Client(
    api_key=self.api_key,           # None when using Vertex AI

    vertexai=self.vertexai,         # True

    credentials=self.credentials,   # Optional service account credentials

    project=self.project,           # Required GCP project ID

    location=self.location,         # Required region (e.g., "us-central1")

    http_options=self.http_options,
)

```

## Prerequisites

Before configuring LangExtract with Vertex AI, ensure your Google Cloud environment is properly set up:

1. **Enable Required APIs**  
   Enable the **Vertex AI API** and **Generative AI API** in your Google Cloud project.

2. **Configure IAM Permissions**  
   Grant your service account the **Vertex AI User** role (`roles/aiplatform.user`) or a custom role containing the `aiplatform.models.predict` permission.

3. **Install LangExtract**  
   Install the library with Gemini support:
   
   ```bash
   pip install "langextract[gemini]"
   ```

## Configuring Vertex AI Authentication in LangExtract

### Basic Configuration

To switch from the default API-key mode to Vertex AI authentication, pass a `language_model_params` dictionary containing `vertexai=True`, your `project` ID, and `location`:

```python
import langextract as lx

vertex_params = {
    "vertexai": True,
    "project": "my-gcp-project-id",
    "location": "us-central1",
}

result = lx.extract(
    text_or_documents="Patient was prescribed 10mg Lisinopril daily.",
    prompt_description="Extract medication names and dosages.",
    model_id="gemini-1.5-flash",
    language_model_params=vertex_params,
)

```

### Authentication Methods

LangExtract supports two credential mechanisms for Vertex AI, both handled by the underlying `genai` library:

**Option A: Application Default Credentials (ADC)**  
The recommended approach for local development and GCE/GKE workloads:

```bash
gcloud auth application-default login

```

When ADC is configured, LangExtract automatically picks up these credentials without explicit configuration in code.

**Option B: Service Account Key File**  
For explicit credential passing, set the environment variable:

```bash
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"

```

Alternatively, pass credentials directly in the parameters (advanced usage):

```python
from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file(
    "/path/to/key.json"
)

vertex_params = {
    "vertexai": True,
    "project": "my-gcp-project-id",
    "location": "us-central1",
    "credentials": credentials,  # Explicit credential object

}

```

## Batch Processing with Vertex AI

For large-scale extraction workloads, LangExtract supports the Vertex AI Batch API through the `gemini_batch` provider. Enable batch mode by extending your `language_model_params`:

```python
vertex_params = {
    "vertexai": True,
    "project": "my-gcp-project-id",
    "location": "us-central1",
    "batch": {
        "enabled": True,
        "threshold": 100,        # Minimum prompts before creating batch job

        "enable_caching": True,  # Store results in GCS for reuse

        "retention_days": 30,
    },
}

```

When batch mode is active, [`langextract/providers/gemini_batch.py`](https://github.com/google/langextract/blob/main/langextract/providers/gemini_batch.py) handles the workflow:
1. Validates the client is a Vertex AI client via `_is_vertexai_client()`
2. Chunks input data and uploads a JSONL file to a GCS bucket named `langextract-<project>-<location>-batch`
3. Submits a Vertex AI batch prediction job
4. Polls until completion and returns ordered results

## Summary

- **LangExtract with Google Vertex AI authentication** requires setting `vertexai=True` in `language_model_params` along with `project` and `location` parameters.
- The `GeminiLanguageModel` class in [`langextract/providers/gemini.py`](https://github.com/google/langextract/blob/main/langextract/providers/gemini.py) constructs a `genai.Client` that authenticates via Application Default Credentials or service account keys.
- For high-volume workloads, enable the Vertex AI Batch API through [`langextract/providers/gemini_batch.py`](https://github.com/google/langextract/blob/main/langextract/providers/gemini_batch.py) by adding a `batch` configuration dictionary.
- This integration enables enterprise security features including IAM controls, VPC Service Controls, and Google Cloud quota management.

## Frequently Asked Questions

### What is the difference between using a Gemini API key and Vertex AI authentication in LangExtract?

**Gemini API key authentication** uses Google's generative language API directly with a key stored in the `LANGEXTRACT_API_KEY` environment variable or passed explicitly, suitable for prototyping and serverless edge deployments. **Vertex AI authentication** routes requests through your Google Cloud project, enabling IAM-based access control, audit logging, VPC Service Controls, and project-specific quota management required for enterprise compliance.

### How do I troubleshoot "Permission denied" errors when using Vertex AI mode?

First verify your service account has the **Vertex AI User** role (`roles/aiplatform.user`) in the Google Cloud Console IAM section. Ensure the **Vertex AI API** is enabled in your project. If using Application Default Credentials, run `gcloud auth application-default login` again to refresh tokens. Check that the `project` and `location` parameters in your `language_model_params` match the project where permissions are granted.

### Can I use LangExtract with Vertex AI in a VPC-SC (VPC Service Controls) environment?

Yes, because LangExtract uses the standard `genai.Client` from Google's Python SDK, it respects VPC Service Controls perimeter configurations. Ensure your runtime environment (Compute Engine, GKE, or Cloud Run) resides within the service perimeter that includes Vertex AI APIs. The batch processing feature in [`langextract/providers/gemini_batch.py`](https://github.com/google/langextract/blob/main/langextract/providers/gemini_batch.py) automatically uses Google Cloud Storage buckets within your project, which must also be included in the VPC-SC perimeter.

### What models are available when using Vertex AI authentication versus the standard API key?

When using **LangExtract with Google Vertex AI authentication**, you can access the same Gemini model families (Gemini 1.5 Flash, Gemini 1.5 Pro, etc.) but through the Vertex AI model registry. Model IDs typically follow the format `gemini-1.5-flash-001` or `gemini-1.5-pro-001`. Additionally, Vertex AI mode enables features like **batch prediction** and **context caching** that are managed through the Vertex AI infrastructure rather than the consumer generative language API.