python-genai is incompatible with mTLS

[andyrzhao]

We recently launched mTLS bound tokens for Agentic workloads. However, it was discovered that the python-genai library is incompatible with mTLS and therefore incompatible with bound tokens. The problem is multi-folds:

1. Unlike python-pubsub or python-aiplatform which are gapic based, the python-genai library is "handwritten" and is missing logic for "automatically enabling mTLS" when workload identity is detected. (https://github.com/googleapis/python-pubsub/pull/1566/files)
2. python-genai uses hard-coded non-mTLS endpoints in several locations (example in _api_client.py), a potential source of 401 rejections.
3. python-genai cannot use "AuthorizedSession" from the core google python api lib (https://github.com/googleapis/google-auth-library-python/blob/main/google/auth/transport/requests.py) due to Async requirements. Currently designed to support httpx and aiohttp, which are also overridable by end user.

We need a comprehensive plan to address these gaps to make python-genai compatible with mTLS.

[Venkaiahbabuneelam]

Hi @andyrzhao, thanks for reaching out to us!

Could you please let us know if the issue still persists or if it has been resolved?

Thanks

[yinghsienwu]

Resolved in #2172