Google AI Studio API Key Setup: Create the Key, Then Check 6 Readiness Blocks

Create the Gemini API key from Google AI Studio first. A created key only proves that a credential exists; it does not prove that the first API request can run. The usable route depends on the Google Cloud project behind the key, the region attached to the workload, billing or Free Tier state, the model chosen, active limits, and whether the key has already been exposed or restricted.

Before writing more code, run these six checks:

Where to create the Google AI Studio API key

The official starting point is Google AI Studio API Keys. Sign in with the Google account that should own the developer project, choose or create a Google Cloud project, then create a Gemini API key. Google's Gemini API key documentation frames the relationship clearly: Gemini API calls need an API key, and keys are created and managed in Google AI Studio.

The project choice matters more than the copy button. A key is not an isolated password. It belongs to a Google Cloud project that has owners, billing state, usage records, rate limits, and recovery paths. If a teammate sends a key from a different project, the application may call the same Gemini model name but use another budget, another limit pool, and another admin boundary.

New users may see Google create a default project after accepting Terms of Service. That can be fine for a first test, but teams should still name the project, know who owns it, and decide whether it is a disposable prototype or the project that will carry production usage. Confusing a default project with the real deployment project is one of the fastest ways to misread billing, quota, and error logs.

Copy the key only once, then store it outside public code. Google allows explicit key use for small tests, but the production habit should be server-side environment variables, deployment secrets, or a secret manager. Avoid frontend bundles, mobile apps, public repositories, screenshots, issue trackers, shared notebooks, and chat logs.

Google AI Studio also has a display boundary. It shows unrestricted keys or keys restricted to the Generative Language API. Deeper API-key restrictions live in Google Cloud Console. If a key exists in the Cloud project but does not look the way a tutorial screenshot shows, check the project and Cloud Console before creating duplicates.

The six checks that matter after key creation

Most failed first requests are not solved by creating another key. They are solved by checking the contract behind the key.

The order is deliberate. Project comes first because every later view depends on it. Region comes before code because unsupported locations can make a correct request fail. Billing and model status come before tuning because Free Tier eligibility and model access are separate. Limits and security come last because they often explain sudden failures after an integration worked once.

For deeper quota and Free Tier decisions, use the separate Gemini API Free Tier limits route. The setup task here is narrower: make the key safe and prove that the first request can run under the current project.

Put the key in an environment variable and make a small first request

The first request should be boring. It should prove that the application reads the key, calls a current model, and receives a response without burning tokens, concurrency, or debugging time.

Use an environment variable for local testing:

hljs bashCopy
export GEMINI_API_KEY="put the real key in a local or server-side secret"
export MODEL_ID="choose a current model ID from Google model documentation"

A minimal curl request can keep the same boundaries clear:

hljs bashCopy
curl "https://generativelanguage.googleapis.com/v1beta/models/${MODEL_ID}:generateContent?key=${GEMINI_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "contents": [
      {
        "parts": [
          { "text": "Reply with one short sentence." }
        ]
      }
    ]
  }'

The exact SDK can change, but the operating rule should not. Read the key from a private environment, keep the prompt small, use a current model ID, and test from the same project and runtime path that the application will use. Add files, tools, long context, retries, queues, and user traffic only after the first request is clean.

Browser applications need one extra stop rule. A Gemini API key is a credential that can spend quota and expose project usage. Do not place it in NEXT_PUBLIC_ variables, client-side JavaScript, downloadable mobile packages, static HTML, or any code path that users can inspect. The safer shape is browser to your backend, backend to Gemini API, key stored on the server side.

Free key creation is not the same as free usage

Google AI Studio can let you create a key without charging at the moment of creation. That does not mean every Gemini API model, feature, region, or traffic level is free. The key authenticates the request; the project owns usage state.

Google's rate limits documentation describes limits such as requests per minute, tokens per minute, and requests per day. Those limits are tied to the project and model state, not to a single key string. Multiple keys in the same project are useful for rotation, environment separation, and access hygiene, but they are not a quota multiplier.

Google's billing documentation separates Free Tier and Paid Tier. Free Tier can cover selected models and conditions. Paid Tier requires an active billing account and, on current setup surfaces, may require a prepay amount such as 10 USD. Because pricing, tier labels, credit treatment, and model rows can change, treat the billing surface as the source of record on the day of deployment.

Free Tier is useful for learning, prototypes, and low-risk tests. Production traffic needs a different posture: budget alerts, ownership, logs, retry policy, data-handling review, and a plan for higher quota or billing. A key that works for a demo should not be treated as a production capacity plan.

Region support and 403 errors need route-specific debugging

Region availability must be checked against the developer route being used. Gemini in a consumer app, Google AI Studio, Gemini API, Vertex AI, Google Workspace, and Android Studio tooling are not the same availability contract.

For Google AI Studio and Gemini API key setup, use Google's available regions documentation. As of April 27, 2026, Taiwan appears in the official Gemini API available-region list. Mainland China, Hong Kong, and Macao do not appear in that AI Studio / Gemini API list. That statement is route-specific; it should not be reused as a claim about every Gemini consumer product or every Google Cloud AI surface.

A 403 PERMISSION_DENIED response should be treated as an ownership and eligibility problem before it is treated as a coding problem. Google's troubleshooting documentation points to causes such as wrong key, insufficient permission, unsupported Free Tier region, and authentication mismatch.

For broader Gemini location issues, use the dedicated Gemini region availability route. The API-key setup path should stay focused on AI Studio, Gemini API, project ownership, and first-request recovery.

Recover from 429, unavailable models, and leaked keys in the right order

429 RESOURCE_EXHAUSTED usually means a limit dimension has been exhausted. The exhausted dimension may be requests, tokens, daily volume, active tier capacity, or retry pressure. A fast loop that retries every failure can turn a small quota event into a larger outage.

Use a low-cost recovery order:

1. Confirm the Google Cloud project behind the key.
2. Open AI Studio active limits for that project.
3. Identify whether RPM, TPM, RPD, or another dimension is the blocker.
4. Reduce concurrency and add exponential backoff.
5. Shorten prompts, cache repeated work, and stop duplicate retries.
6. Confirm that the target model fits the current billing and tier state.
7. Request higher quota or move to a billed project when normal traffic still hits limits.

Model failures need a separate habit. Do not copy a different preview ID from a video or forum post. Google's models documentation is the current source for model names and status. One concrete boundary matters here: Gemini 3 Pro Preview was shut down on March 9, 2026, so old examples that target it are not a reliable setup baseline.

Leaked keys need rotation, not optimism. If a key has been committed, pasted, logged, shown in a screenshot, uploaded into a client bundle, or shared through an untrusted tool, create a new key, update server-side secrets, remove public copies, inspect usage and billing, and disable or delete the compromised key. Google can proactively block leaked API keys, so keeping the old key in production is not a recovery plan.

Security also belongs in the setup checklist. A ready integration should be able to answer who can read the key, which project records usage, how the key is rotated, and who handles billing anomalies. If those answers are unclear, the setup is not finished.

AI Studio, Vertex AI, Android Studio, and gateways are different routes

Several tutorials and product snippets use similar words for different products. Separate the route before copying setup steps.

For the primary setup task, use the official AI Studio key route. Move to Vertex AI when the project needs Cloud IAM, regional endpoints, enterprise governance, or existing GCP controls. Evaluate gateways only as separate provider contracts with their own model coverage, pricing, logs, support, and exit plan. Do not treat any gateway as an official Google workaround.

Final readiness checklist

The setup is ready when every row has a concrete answer:

If any row is still unknown, the key has been created but not operationally set up. Resolve the unknown before connecting real user traffic or long-running jobs.

FAQ

Is a Google AI Studio API key free?

Creating the key does not normally equal a charge by itself, but usage depends on the project, model, region, Free Tier eligibility, billing state, and active limits. Check current Google billing and pricing surfaces before calling a workload free.

Should I use GEMINI_API_KEY or GOOGLE_API_KEY?

Google's Gemini API key documentation says Gemini API libraries can use GEMINI_API_KEY or GOOGLE_API_KEY. Pick one convention for the team, document where it is stored, and keep the value out of frontend and public code.

Can multiple API keys increase Gemini API quota?

No. Quota belongs to the project and model state, not to each key string. Multiple keys in one project help with rotation, environment separation, and security management, but they do not multiply active limits.

Why does a new key return 403 PERMISSION_DENIED?

Common causes include the wrong project, insufficient permission, unsupported region or Free Tier location, missing billing requirement, unavailable model, or authentication mismatch. Check project, region, billing, and model status before rewriting application code.

Why did the integration work yesterday and return 429 today?

The project may have exhausted RPM, TPM, RPD, or another active limit. Retry loops, longer prompts, higher traffic, model changes, and project tier changes can all make a previously working request fail.

Can Mainland China, Hong Kong, or Macao use Google AI Studio / Gemini API directly?

As of April 27, 2026, those three locations do not appear in Google's official AI Studio / Gemini API available-region list, while Taiwan appears in the list. Re-check the official region page before deployment because region support can change.

Does Gemini app access prove that Gemini API access works?

No. Gemini consumer surfaces, AI Studio, Gemini API, Vertex AI, Workspace, and Android Studio tooling have different product, region, account, billing, and data boundaries. Debug the route that the key actually uses.

What should I do if the API key leaked?

Create a new key, update server-side environment variables or secrets, remove the leaked value from public locations, inspect usage and billing, then disable or delete the compromised key. Do not keep using a key that has been exposed.

When should I choose Vertex AI instead of AI Studio?

Use AI Studio / Gemini API for quick developer setup and small integrations. Choose Vertex AI when the team needs GCP IAM, regional endpoints, enterprise governance, Cloud billing controls, and a Cloud-native deployment contract.

Which model ID should setup examples use?

Use a configurable MODEL_ID and fill it from current Google model documentation. Avoid hardcoding old preview IDs. Model availability, names, and preview status can change independently from the API key itself.