KeyKeeperGoogle Gemini
How an agent gets a Google Gemini key through KeyKeeper, what to choose on aistudio.google.com, and how KeyKeeper verifies it.
| Template id | gemini (also google-ai, google-gemini, aistudio) |
|---|---|
| Field | gemini-api-key → GEMINI_API_KEY · secret |
| Key looks like | whether it can be viewed again is unconfirmed |
| Created at | aistudio.google.com |
| Verified by KeyKeeper | GET https://generativelanguage.googleapis.com/v1beta/models — lists the models this key can use |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show gemini
keykeeper save --provider gemini --from-clipboard --create --purpose "what this task does"
keykeeper run -c gemini -- <your command>--provider gemini fills in the credential id and the field. The environment
variable is the one Google Gemini's own tools read, so nothing has to be mapped.
What only you can do
Log in with the Google account
Accept the terms on first use
Choose or import a Google Cloud project
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Create the key restricted to the Gemini API only (the default). Standard unrestricted keys are rejected by Gemini API starting September 2026.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Google Gemini key (whether it can be viewed again is unconfirmed). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
- After saving: KeyKeeper itself sends
GET https://generativelanguage.googleapis.com/v1beta/modelswith the key in thex-goog-api-keyheader (lists the models this key can use). The agent receives accepted, rejected or could not reach — never the value.
Rotation and expiry
The public Gemini key guide does not promise one universal expiry or recovery policy; review it in Google Cloud. Rotate or revoke at aistudio.google.com.