How do you get a Gemini API key, and keep it safe?

Creating the key

• Open Google AI Studio and sign in with a Google account.
• Choose Get API key and create a key, either in a new project or an existing Google Cloud project.
• Copy the key and store it as an environment variable, such as GEMINI_API_KEY.

Free tier and data use

Many Gemini models can be used free within rate limits, which makes the API popular for prototypes. Google's pricing page states that content sent on the free tier may be used to improve its products, while paid-tier content is not. Do not send customer or personal data through a free-tier key. Enabling billing on the project moves it to paid limits.

Using it from your server

This example uses a reserved domain. Replace the host and model with the current endpoint and model ID from the provider's documentation before running it.

curl "https://api.gemini.example/v1beta/models/MODEL_NAME:generateContent" \
  -H "x-goog-api-key: $GEMINI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"contents": [{"parts": [{"text": "Hello"}]}]}'

Google's SDKs read the key from the environment. Check the models page for current model names.

Keeping it safe

• Keep it on the server and call Gemini from an API route or function, not from browser JavaScript.
• Restrict the key in Google Cloud's credentials page to the Generative Language API, so a leaked key cannot be used for other Google services.
• Set budgets and alerts on the Cloud billing account once billing is enabled.
• Use separate projects and keys for development and production.

Google API keys for some services, such as Maps, are designed to be used in browsers with referrer restrictions. A Gemini key is not one of them. Treat it as a server secret.

Common errors

• 400 API key not valid: wrong or revoked key, or a restriction that blocks this API.
• 403 permission denied: the API is not enabled for the key's project, or the key is restricted elsewhere.
• 429 resource exhausted: free-tier or quota limits reached. Back off, or enable billing for higher limits.

What a scan can and cannot tell you

WebAuditOS does not currently detect API keys in your JavaScript. It checks related exposure on your site, such as wide-open CORS, HTML error pages with recognizable debug output and directory listings.

Search your built frontend for the key before launch, and review usage in Google Cloud.

AI app builders sometimes place Gemini calls in client code. If the network panel shows requests to generativelanguage.googleapis.com from your page, the key is public.

Short answers

Is the Gemini API free? Many models have a free tier with rate limits. Paid use is billed per token.

Is my data used for training on the free tier? Google's pricing page says free-tier content may be used to improve its products.

Where do I get a Gemini API key? In Google AI Studio.

Can I restrict a Gemini key? Yes, in Google Cloud's API credentials settings.