Using Bitbucket Agentic Pipelines with Claude provider routed to Google Cloud Vertex AI (no Anthropi

[CAIO JUNIO GOUVEA]

Our organization is a public institution and cannot establish a direct contract with Anthropic to obtain an API key. However, we already have an active Google Cloud Platform contract and a Service Account with access to Vertex AI.

We are trying to use Bitbucket Agentic Pipelines with provider: claude, routing all Claude Code calls to Vertex AI instead of the Anthropic API directly. The approach is to set the following environment variables via config.overrides.env in the agent definition:

• CLAUDE_CODE_USE_VERTEX: "1" — to redirect Claude Code to Vertex AI
• ANTHROPIC_VERTEX_PROJECT_ID — pointing to our GCP project
• CLOUD_ML_REGION — set to us-east5
• GOOGLE_APPLICATION_CREDENTIALS — pointing to a temporary file written from a secured repository variable containing our Service Account JSON key

The Atlassian support team confirmed that these variables set in config.overrides.env should route calls to Vertex AI and are not blocked by Bitbucket's security filters.

Questions:

1. Is this approach officially supported by Agentic Pipelines?
2. Has anyone successfully used this setup in production?
3. Are there any known limitations or gotchas when authenticating via Service Account key file with this setup?

Any experience or guidance would be greatly appreciated. Thanks!

[Ben · Accepted solution]

Hi @CAIO JUNIO GOUVEA 

You are correct in stating that config.overrides.env does pass env vars to the Claude CLI, so the approach is plausible.

Whilst we do support "any non-interactive auth method", we can't guarantee Vertex-specific behaviour. This is because Vertex AI auth is not explicitly documented or tested by us due to it being a Claude Code CLI capability (out of scope).

The only potential gotcha I can see from your setup is the credentials being contained in a temporary file. You'd need to echo the contents of this secured variable into a file prior to agent invocation within the script block.

Hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)

[CAIO JUNIO GOUVEA]

Hi Ben,

Thanks for the clarification.

That was actually exactly the approach I ended up using. The service account credentials are stored as a secured variable, then written to a temporary file before invoking the agent, and the relevant Vertex AI environment variables are passed through config.overrides.env.

So far, this setup has been working very well and Claude Code has been authenticating successfully through Vertex AI without any issues.

I understand this isn't officially supported or tested by Bitbucket since it's a Claude Code capability, but I wanted to confirm that in practice the approach is functioning as expected.

Thanks for the help!