Gemini API Key: Setup and Secure Sharing

Google AI Studio API key setup and environment variables

Create or select the intended project in Google AI Studio, then create a key on its API Keys page. Keep development and production access separate. If your project is missing, import it in AI Studio and ask the project administrator for the required permissions.

The Gemini SDKs read GEMINI_API_KEY or GOOGLE_API_KEY automatically; if both exist, GOOGLE_API_KEY takes precedence. GOOGLE_GEMINI_API_KEY is a custom variable name, not the documented auto-detected default: explicitly pass its value to your SDK client if your application uses that name.

For local development, put GEMINI_API_KEY=your-local-key in an ignored .env.local file and load it on the server with your framework or dotenv loader. Commit only a placeholder in .env.example. In production, inject the value from a secret store and keep it out of NEXT_PUBLIC_* variables, browser bundles, and logs.

Restrict, rotate, and troubleshoot your Gemini key

In AI Studio, restrict an unrestricted standard key to the Gemini API only. In Google Cloud Credentials, review API and application restrictions for your runtime; server IP restrictions must match its actual egress addresses. A restriction is not a substitute for keeping the key private.

For planned rotation, create a replacement, update your server-side secret store, restart or redeploy consumers, verify requests, and revoke the old key. If there is active abuse, revoke the compromised key promptly even if it interrupts service. Share a replacement with a fresh one-time link, then store it durably.

If authentication fails, check which environment variable the running process loaded, whether an old GOOGLE_API_KEY overrides GEMINI_API_KEY, and whether the key's restrictions allow the request. For quota errors, inspect the linked project's quotas and billing. Budget alerts notify you of spending; they do not cap it. Never paste the key into a support ticket or screenshot.

How to create a Google Gemini API key

SnapPwd does not issue Google credentials—Google does. To create a Gemini API key, open Google AI Studio at aistudio.google.com, sign in with your Google account, and click 'Get API key'. Studio either reuses an existing Google Cloud project or creates one for you, then generates a key tied to that project's Generative Language API.

For production or organization-managed setups, you can instead create the key in the Google Cloud Console: enable the Generative Language API on your project, open APIs & Services → Credentials, and create an API key there. This route gives you tighter control over restrictions, quotas, and billing alerts.

Once the key exists, the security problem shifts from creating it to moving it safely—getting the key from whoever generated it to whoever needs it, without leaving a copy behind in chat history, email, or a shared doc. That is the step SnapPwd handles.

Storing and restricting a Gemini API key

After the key is created, never hard-code it. Read it from an environment variable (for example GEMINI_API_KEY or GOOGLE_API_KEY) loaded from a .env file that is listed in .gitignore, or pull it from a secrets manager such as Google Secret Manager. Review API and application restrictions in Google Cloud Credentials for your server runtime.

When a recipient opens a one-time SnapPwd link, they should immediately move the key into their own environment file, password manager, or secrets store rather than leaving it sitting in the browser tab. The link self-destructs after a single view, so there is no lingering copy to find later.

Billing risk and revoking a leaked key

A Gemini API key bills usage to its linked Google Cloud project. If the key leaks, an attacker can run paid Generative Language API calls on your account until the key is disabled, so a leak is a financial exposure, not just a security one. Set a budget and billing alert on the project so unexpected usage surfaces quickly.

To revoke a Gemini key, delete it in Google AI Studio or in the Cloud Console's Credentials page, then generate a replacement and review recent billing for any usage you do not recognize. Distribute the new key only through a fresh one-time link so the same exposure cannot happen on the old channel.