Google AI Studio API Key: Create It, Secure It, and Verify Your First Call

A Google AI Studio API key is the credential your application uses to call the Gemini Developer API. It is not a Gemini consumer subscription, a prepaid package, or a separate quota pool. Every key belongs to a Google Cloud project, and that project is where permissions, collaborators, usage, and billing meet.

The useful finish line is therefore not “I copied a string.” It is: the key belongs to a project you control, the secret is outside client code, and one minimal request returns a result you can identify.

Check eligibility before creating anything

Open Google’s current AI Studio and Gemini API region list before following an old video. Google also applies an 18+ requirement and may require age verification. A country appearing on the list does not prove that a particular account, organization policy, or payment method is eligible, but a country missing from the list is a reason to stop the direct route rather than improvise a workaround.

For an eligible US developer, the normal path starts at Google AI Studio API Keys. Sign in with the Google account that should own or administer the project. Do not create a production credential under a personal account if an organization is supposed to control billing, access, rotation, and incident response.

Create the key in the right Cloud project

Google’s current Gemini API key documentation describes two onboarding states:

• A new AI Studio user may receive a default Cloud project and API key after accepting the terms.
• A user who already has Google Cloud projects may need to open Dashboard → Projects, import the intended project, and then create a key from the API Keys page.

Before clicking Create API key, identify the project by name and project ID. The ID matters more than a friendly label when you later compare billing, logs, quota, and deployed configuration.

After creation, check the Key Type column. Google is moving the Gemini API from standard keys to authorization keys. New keys created in AI Studio are now auth keys, and the current documentation says standard keys will be rejected in September 2026. That deadline is operationally important and also volatile: use the live documentation as the source of truth when you migrate or launch.

If the button says you do not have permission to create a key, random retries will not help. The project administrator must review the narrow permissions Google lists for project lookup, key creation, service enablement, service-account creation, and key binding. Use a project you are authorized to manage; do not solve an IAM problem by borrowing another person’s credential.

Put the secret outside your code

Treat the key like a password. Google explicitly warns that a leaked key can consume project quota and create unexpected charges. Never commit it to Git, paste it into an issue, include it in a screenshot, or hardcode it in a production web or mobile bundle.

For a local shell, the current client libraries recognize either GEMINI_API_KEY or GOOGLE_API_KEY. If both are set, GOOGLE_API_KEY takes precedence. That detail can explain why replacing one variable appears to have no effect.

bash
export GEMINI_API_KEY="YOUR_API_KEY"

Use this placeholder in documentation; insert the real value only in your own secure environment. For production, keep the credential in a server-side secret manager and have the browser or mobile client call your backend. An API restriction is useful, but it does not make a key embedded in client code private.

You can confirm that the variable exists without printing its value:

bash
if [ -n "${GEMINI_API_KEY:-}" ]; then
  echo "GEMINI_API_KEY is set"
else
  echo "GEMINI_API_KEY is missing"
fi

Make one minimal request

Google’s current get-started guide uses the Interactions endpoint and gemini-3.7-flash. The following canary keeps the key in a header expanded from the environment rather than placing it in the URL:

bash
curl -sS -X POST "https://generativelanguage.googleapis.com/v1beta/interactions" \
  -H "x-goog-api-key: $GEMINI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gemini-3.7-flash",
    "input": "Reply in one short sentence: the API connection works."
  }'

A working call returns an interaction object with a completion status and model output. The exact prose is not the test. The test is that the request reaches the expected hostname, authenticates with the intended project credential, and returns a successful structured response.

Model names and API surfaces change. If Google’s current quickstart no longer shows this model or endpoint, update the canary from that page rather than substituting a model ID from an old tutorial.

Turn a failure into evidence

Do not rotate keys, projects, endpoints, and models at the same time. Preserve the HTTP status, sanitized error body, selected project ID, endpoint hostname, model, UTC timestamp, and request ID if one is returned. Never preserve the full key.

This ladder separates credential setup from capacity. A successful key can still hit a model-specific limit; a paid project can still use the wrong credential; a visible model can still require a different serving route.

Decide whether Free or Paid fits after the canary

Creating a key does not cost money by itself. New accounts can start on Free for certain models, but Free eligibility is model- and serving-mode-specific. Your active limits are the values AI Studio shows for the selected project and model, not a universal number from a blog post.

Only after the canary works should you decide whether the workload needs billing. Google’s current billing flow links a billing account to the project and may assign Prepay with a minimum credit purchase. For model prices and account-level decisions, use the Gemini API pricing guide and verify the live pricing page. A second key in the same project is not a second quota pool.

Before production, record the project ID, credential owner, key type, secret location, rotation owner, allowed backend, selected model, active AI Studio limits, and billing status. That short record is what turns a copied key into an operable integration.