> ## Documentation Index > Fetch the complete documentation index at: https://docs.brm.ai/llms.txt > Use this file to discover all available pages before exploring further. # Google Vertex AI Usage Integration This article walks you through connecting your Google Vertex AI project to BRM so we can show your team's per-model token usage and spend. ***Why this matters:***\_ AI spend on hyperscalers like Google Cloud is easy to lose inside a much larger cloud bill. This connection gives you a clear, per-model view of what's actually running and what it costs.\_ ⚠️ **Important:** This is **not** a Gemini API key from AI Studio. BRM needs a **Google Cloud service-account key**, which is a different type of credential created inside your Google Cloud project. The setup has three steps, outlined below. Complete steps 1 and 2 in Google Cloud first, then connect in BRM to complete step 3: 1. **Set up token usage tracking** — in a Google Cloud service account with read-only access to Cloud Monitoring. 2. **Set up spend** tracking — with a one-time billing export to BigQuery, plus read-only BigQuery access for the same service account. 3. **Connect in BRM** — enter the project ID, service-account key, and billing export details together. If you are able, complete the spend setup **before** you connect. The billing export only starts collecting data from the moment you turn it on, so every day it's off is another day of untracked spend history. If you are unable to get billing-admin access yet, you can connect with token usage only and add the spend details later by reconnecting the integration. ℹ️ Google Cloud only keeps about six weeks of monitoring history, so token usage builds up going forward rather than backfilling years of past data. Spend is different: BRM pulls up to a year of history from the billing export — but the export itself only contains data from the date it was enabled. ## What you'll need | **Credential** | Google Cloud service-account JSON key | | :------------------------ | :-------------------------------------------------------------------------------------------------------------- | | **Also needed** | The GCP project ID where your Vertex AI traffic runs | | **Roles for token usage** | Monitoring Viewer on that project | | **Roles for spend** | BigQuery Data Viewer (on the billing-export dataset)
and BigQuery Job User (on the billing-export project) | | **Spend details** | Billing-export project ID, dataset name, and billing account ID | | **Who can do this** | A project IAM admin or owner, plus a billing admin for the spend integration | ## Part 1: Token usage | **Credential** | Google Cloud service-account JSON key | | :------------------ | :--------------------------------------------------- | | **Also needed** | The GCP project ID where your Vertex AI traffic runs | | **Role required** | Monitoring Viewer on that project | | **Who can do this** | A project IAM admin or owner | ### Step 1: Identify your project Find the GCP project ID where your Vertex AI traffic runs. You'll enter this into BRM later. ### Step 2: Enable Cloud Monitoring In Google Cloud Console, ensure the **Cloud Monitoring API** is enabled for this project. If you're comfortable with the command line, you can accomplish this with the following command: ```bash theme={null} gcloud services enable monitoring.googleapis.com --project=PROJECT_ID ``` ### Step 3: Create a service account [Create a new service account](https://docs.cloud.google.com/iam/docs/keys-create-delete) and name it brm-vertex-usage. Command-line equivalent: | `gcloud iam service-accounts create brm-vertex-usage \` `  --project=PROJECT_ID \` `  --display-name="BRM Vertex AI usage read-only"` | | ------------------------------------------------------------------------------------------------------------------------------------- | ```bash theme={null} gcloud iam service-accounts create brm-vertex-usage \ --project=PROJECT_ID \ --display-name="BRM Vertex AI usage read-only" ``` ### Step 4: Grant the Monitoring Viewer role Grant the service account the [**Monitoring Viewer** role](https://docs.cloud.google.com/iam/docs/roles-permissions/monitoring) (roles/monitoring.viewer) on the project. This is read-only — it does not let BRM change anything in your Google Cloud project. Command-line equivalent: ```bash theme={null} gcloud projects add-iam-policy-binding PROJECT_ID \ --member="serviceAccount:brm-vertex-usage@PROJECT_ID.iam.gserviceaccount.com" \ --role="roles/monitoring.viewer" ``` ## Part 2: Spend ℹ️ Claude models on Vertex AI bill as their own line item (for example, "Claude Opus 4.6"), rather than a single generic "Vertex AI" line. BRM automatically matches these billing rows back to the same models you see in token usage, so spend and usage line up per model. ### Step 1: Turn on the detailed billing export In Google Cloud Console, go to **Billing → Billing export → BigQuery export → Detailed usage cost → Edit settings**. Choose or create a BigQuery dataset to receive the [export](https://cloud.google.com/billing/docs/how-to/export-data-bigquery), then save. A billing admin needs to do this step. ⚠️ It must be the **Detailed usage cost** export. The "Standard usage cost" export writes a different table that BRM can't use. ℹ️ Google doesn't offer a command-line way to turn this export on — it must be done in the console. After you enable the export, Google creates the export table (named `gcp_billing_export_resource_v1_...`) on its first export run. This can take a few hours, occasionally up to a day. **Wait until the table appears in the dataset before connecting in BRM**. BRM verifies it can read the table when you connect, so connecting too early will fail. ### Step 2: Share the BigQuery dataset with your service account Go to **BigQuery → select the billing-export dataset → Sharing → Permissions → Add principal**. Then add `brm-vertex-usage@PROJECT_ID.iam.gserviceaccount.com` (using your Vertex project's ID) with the role [**BigQuery Data Viewer**](https://cloud.google.com/bigquery/docs/control-access-to-resources-iam), and save. ℹ️ Grant access at the **dataset** level. Sharing only the export table itself is not enough — BRM needs dataset-level read access to find and query the table. ### Step 3: Grant BigQuery Job User Grant the service account **BigQuery Job User** (roles/bigquery.jobUser) on the project that holds the billing export. This is often a different project from the one running your Vertex AI traffic. Command-line equivalent (replace both placeholders with your real project IDs): ```bash theme={null} VERTEX_PROJECT="PROJECT_ID" # project running Vertex AI traffic BILLING_EXPORT_PROJECT="BILLING_EXPORT_PROJECT_ID" # project holding the billing export gcloud projects add-iam-policy-binding "$BILLING_EXPORT_PROJECT" \ --member="serviceAccount:brm-vertex-usage@${VERTEX_PROJECT}.iam.gserviceaccount.com" \ --role="roles/bigquery.jobUser" ``` ### Step 4: Note down the billing export details You'll enter these into BRM in the next part, alongside the project ID and key: * The billing-export project ID * The billing-export dataset name * The billing account ID (shown on the Billing export page, e.g. ABCDEF-123456-789ABC) ## Part 3: Connect in BRM ### Step 1: Create a JSON key Create a JSON key for the service account and download it. Command-line equivalent: ```bash theme={null} gcloud iam service-accounts keys create brm-vertex-usage-key.json \ --iam-account=brm-vertex-usage@PROJECT_ID.iam.gserviceaccount.com ``` ℹ️ If this step fails with an organization-policy error, your GCP organization may block service-account key creation (`iam.disableServiceAccountKeyCreation`). Ask your GCP org admin to allow an exception for this service account. ### Step 2: Enter everything in BRM In BRM, open the Google Vertex AI integration setup, found by clicking on your profile in the lower-left hand corner of the screen, navigating to Integrations, then clicking on "Connect" next to "**Gemini Enterprise Agent Platform**" and enter: * Your GCP project ID * The full contents of the JSON key file * The billing-export project ID * The billing-export dataset name * The billing account ID Screenshot 2026 07 07 At 1 57 42 PM ℹ️ The three billing-export fields go together — fill in all three. (If you're connecting with token usage only for now, leave all three empty; entering just one or two won't work.) ### Step 3: Delete your local copy of the key Once it's entered into BRM, delete the local copy of the JSON key file from your computer, unless your security policy requires you to keep a managed backup. ## Part 2: Spend The billing export is forward-only — it starts collecting from the moment you turn it on and will not backfill older billing history. | **Already have** | The service account from Part 1 | | :------------------- | :-------------------------------------------------------------------------------------------------------------- | | **New roles needed** | BigQuery Data Viewer (on the billing export dataset)
and BigQuery Job User (on the billing export project) | | **Also needed** | Billing-export project ID, dataset name, and billing account ID | | **Who can do this** | A billing admin, in addition to the project IAM admin from Part 1 | Navigate to **BigQuery → select the billing-export dataset → Sharing → Permissions → Add principal**. | `VERTEX_PROJECT=PROJECT_ID` `BILLING_EXPORT_PROJECT=BILLING_EXPORT_PROJECT` `gcloud projects add-iam-policy-binding "$BILLING_EXPORT_PROJECT" \` `  --member="serviceAccount:brm-vertex-usage@${VERTEX_PROJECT}.iam.gserviceaccount.com" \` `  --role="roles/bigquery.jobUser` | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ## Multiple projects Set up **one BRM integration per Vertex AI project**. If you run Vertex AI traffic in several projects, you don't need a separate service account for each: grant the one service account Monitoring Viewer on each project (or at the folder or organization level), and create one BRM integration per project, all using the same key. ## Security notes * Token usage only requires Monitoring Viewer — a read-only role. * Spend only adds BigQuery job execution plus dataset-scoped read access — also read-only. * BRM cannot run inference, read prompts or responses, or change any Google Cloud resources or billing settings with these roles. * You can rotate or revoke the service-account key at any time from Google Cloud. Note that revoking the key stops BRM's syncing until you enter a new key by reconnecting the integration in BRM. ## Common mistakes * **Sending a Gemini API key instead of a service-account JSON key.** These are different credential types — BRM needs the service account. * **Granting Vertex AI permissions but not Monitoring Viewer.** BRM reads from Cloud Monitoring specifically; thus the integration requires this role. * **Turning on the Standard usage cost export instead of Detailed usage cost.** BRM reads the detailed (resource-level) export table. * **Connecting in BRM before the export table exists.** Google creates the table on the first export run after you enable it, which can take up to a day. Wait for it to appear, then connect. * **Entering only some of the billing export fields.** The billing-export project ID, dataset name, and billing account ID go together — enter all three or none. * **Granting BigQuery access too broadly — or too narrowly.** Use dataset-scoped "BigQuery Data Viewer" on the billing-export dataset: not project-wide access, and not table-only access either. * **Pointing one integration at multiple projects.** Set up one BRM integration per Vertex AI project (they can share a service account — see "Multiple projects" above). ## Provider documentation Our steps above should stay current, but if Google Cloud changes their interface, these are the source-of-truth docs: * [Create and delete service-account keys](https://docs.cloud.google.com/iam/docs/keys-create-delete) * [Service-account credentials](https://docs.cloud.google.com/iam/docs/service-account-creds) * [Cloud Monitoring roles and permissions](https://docs.cloud.google.com/iam/docs/roles-permissions/monitoring) * [Cloud Monitoring timeSeries.list API](https://docs.cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list) * [Google Cloud metrics overview](https://docs.cloud.google.com/monitoring/api/metrics_gcp) * [Cloud Billing export to BigQuery](https://cloud.google.com/billing/docs/how-to/export-data-bigquery) * [BigQuery IAM access](https://cloud.google.com/bigquery/docs/control-access-to-resources-iam) ## Still stuck? Reach out to BRM support and let us know which step you're stuck on. Don't send your JSON key over email or chat — we'll point you to a secure way to share it if needed.