Gemini API Key: Create, Configure and Keep It Out of Your Notes
A Gemini API key authenticates your requests to Google's AI models. Here is how to create one in Google AI Studio, configure quotas and restrictions, rotate it safely, and record the setup decisions that belong outside the secret.
Updated 4 min read
A Gemini API key authenticates your code with Google's AI models. You create it in Google AI Studio, include it in each API request, and Google uses it to track usage against your account. Tools like fenbs let you record the setup decisions around the key, such as which model version the team agreed to use and what the integration is allowed to process, so those decisions are available to collaborators and connected AI assistants without touching the secret itself.
The key itself is straightforward to create. Managing it well, and keeping the surrounding project setup documented, takes more attention.
Where to create a Gemini API key
Go to Google AI Studio at https://aistudio.google.com and sign in with a Google account. In the left navigation, select "Get API key". You can create a key associated with a new Google Cloud project or an existing one. The key appears once; copy it immediately to a secure location.
Google AI Studio is the starting point for most individual and small-team setups. For higher-volume use or enterprise requirements, keys can also be managed through the Google Cloud Console under the AI Platform section. Check Google's own documentation at https://ai.google.dev for the current setup options.
What the key controls
The key identifies your account and determines which models you can call. It does not carry permissions beyond your account's plan. If you are on a free tier, the key is subject to the free tier rate limits. If you have billing enabled, the key can make requests up to your configured quota.
One key can access multiple Gemini model versions. Which version you call is set in your request, not in the key itself. Record the approved model version in your project documentation so team members use the same model and billing stays predictable.
How to configure quotas and restrictions
In the Google Cloud Console, you can set API restrictions on a key. Restricting a key to specific APIs limits the damage if the key is exposed. For a Gemini integration, restrict the key to the Generative Language API.
Usage quotas for the Gemini API are managed at the project level in the Google Cloud Console under APIs and Services. Set a daily request limit and a monthly spending budget with an alert threshold. Without those limits, a loop or a bug in your code can exhaust your quota or accumulate unexpected charges before you notice.
Where the key must not live
Never commit a Gemini API key to a code repository, paste it into a shared document, or include it in a chat. Even private repositories can be exposed. Treat the key as a password.
- Store the key in an environment variable. Use a
.envfile in development, listed in.gitignore, and your deployment platform's encrypted secrets in production. - Never log the key value. Logs are often stored and shared more broadly than the application code.
- Do not store the key in a notes app, a shared doc, or a task description. Use a secrets manager or environment variables.
- If you use fenbs to record project decisions, record which model and use cases are approved, not the key itself.
Record the setup decisions in fenbs, not the key
Add the integration project to fenbs. Write the approved model version, the agreed use cases, any restrictions on input data, and the troubleshooting notes from setup as Decisions and rules or tasks. Connected AI assistants read those records before working on the integration. If someone joins the project later, they find the decisions without needing to ask anyone.
Create a free accountFree for one person · No credit card · Works with Claude, ChatGPT, Cursor and more
Rotating a key and handling errors
Rotate the key whenever you suspect it has been exposed: shared in a message, committed accidentally, or seen by someone who should not have it. In Google AI Studio, create a new key, update all places the old key is used, verify the new key works, then delete the old one. Do not delete the old key before the new one is confirmed working.
A 403 response from the API usually means the key is invalid or the API is not enabled on your project. A 429 means you have hit a rate limit. Check the Google Cloud Console quota page for the current state of your limits and whether you need to request a quota increase. For more on managing credentials across a project, see the Claude API key guide and the Codex API key guide.
Testing the key before using it in production
After creating a key, verify it works before wiring it into a larger project. A simple test call, sending a short prompt and checking for a valid response, confirms the key is active, the API is enabled on your project, and the model you intend to use is accessible from your account.
Test with a small prompt rather than a production-scale input. If the test works but the production call fails, the difference is usually input size, format, or a rate limit you only hit at volume. Diagnosing those problems is easier when you have a known-good baseline.
How to do this with fenbs
- Create a free account. Add a project for the Gemini integration.
- Add a task for the initial key setup. Note which Google Cloud project the key belongs to and which model version is approved.
- Open Decisions and rules and record the approved model, the use cases the key is allowed for, and any restrictions on what data the API may receive.
- When you rotate a key or change a quota, add a task to track the work and note the outcome when it is done.
- Connect a supported AI assistant from Integrations if you want it to read the project rules before working on the integration code.