Authentication Guide

Authentication & API Keys

Set up secure authentication for Gemini CLI to access Google's AI services. Learn about API keys, OAuth, and security best practices.

Authentication Methods

API Key

Simple and direct authentication

• Quick setup
• Best for personal use
• Environment variables
• No browser required

OAuth 2.0

Secure delegated access

• More secure
• Team collaboration
• Granular permissions
• Token refresh

Service Account

Server-to-server authentication

• Production ready
• CI/CD integration
• No user interaction
• JSON key files

API Key Setup (Recommended)

Get Your API Key

First, you'll need to create an API key from Google AI Studio:

1.
Visit Google AI Studio
Sign in with your Google account
2.
Click the "Create API Key" button
Choose an existing project or create a new one
3.
Copy your API key and store it securely
This key will only be shown once

Security Warning

Never share your API key publicly or commit it to version control. Treat it like a password and store it securely.

Configure Gemini CLI

Interactive Authentication

The easiest way to set up authentication. Gemini CLI will prompt you for your API key.

# Start interactive authentication
gemini auth login

# Follow the prompts to enter your API key
# The key will be securely stored for future use

OAuth 2.0 Setup (Advanced)

When to use OAuth

OAuth is recommended for team environments, applications that need granular permissions, or when you want to avoid storing API keys directly.

1. Create OAuth Credentials

Go to Google Cloud Console
Create or select a project
Click "Create Credentials" → "OAuth 2.0 Client ID"
Configure OAuth consent screen if prompted
Select "Desktop application" as application type
Download the JSON credentials file

2. Configure OAuth

# Set credentials file path
export GOOGLE_APPLICATION_CREDENTIALS="path/to/credentials.json"

# Start OAuth flow
gemini auth login --oauth

# This will open a browser for authentication
# Follow the prompts to authorize access

Service Account (Production)

Production Use

Service accounts are ideal for production environments, CI/CD pipelines, and server-to-server authentication where no user interaction is possible.

1. Create Service Account

Go to Service Accounts page
Click "Create Service Account"
Enter name and description
Grant necessary roles (AI Platform User)
Create and download JSON key file

2. Configure Service Account

# Set service account key file
export GOOGLE_APPLICATION_CREDENTIALS="path/to/service-account-key.json"

# Verify authentication
gemini auth status

# Alternative: Use gcloud to activate service account
gcloud auth activate-service-account --key-file="path/to/service-account-key.json"

Verify Authentication

Check Authentication Status

# Check current authentication status
gemini auth status

# Test with a simple query
gemini ask "Hello, can you hear me?"

# Check available models
gemini models list

Expected Output

✓ Authentication: Success
✓ API Key: ••••••••••••••••••••••••••••••••••••••••abc123
✓ Project: my-ai-project
✓ Quota: 1000 requests/day remaining
✓ Models: gemini-pro, gemini-pro-vision available