Gemini API: API key not valid (API_KEY_INVALID)

What it means in plain English

The Generate Content API rejected the key on the request. Google's error reference shows HTTP 400, status INVALID_ARGUMENT, and this body: "API key not valid. Please pass a valid API key." The ErrorInfo reason is API_KEY_INVALID.

That is not a rate limit. A 429 RESOURCE_EXHAUSTED means you passed the limits. A 402 whose message is "Your Prepay credit balance is depleted" means the billing account is out of Prepay credits, and Google says not to retry until credits are added.

Likely causes

• The request has no key, or the key was copied with a missing character.
• The key is an unrestricted standard key. Google says the Gemini API rejects those. A standard key with explicit restrictions still works.
• The key was hardcoded in a web or mobile app. Google's API-key guide says never expose keys client-side in production, and to run a backend proxy that makes the API call.
• The key was dormant and unrestricted. From 7 May 2026, Google says those keys are blocked and show a Blocked tag in AI Studio.

How to fix it, step by step

1. Stop calling generativelanguage.googleapis.com from the browser. Google says keys compiled into client-side code can be extracted, and the fix is a backend proxy.
2. On the server, set GEMINI_API_KEY or GOOGLE_API_KEY. The client libraries read those names. If both are set, GOOGLE_API_KEY wins. Google says not to hardcode the key in a web or mobile app.
3. In Google AI Studio, on the API Keys page, find keys marked Unrestricted. Google says to choose Add restrictions, then Restrict to Gemini API only, then Restrict key. You need apikeys.keys.update on the Cloud project.
4. If the key was already in a deployed bundle, create a new key, deploy the server with that key, then disable the old key. Google says not to delete the old key until the new one is working, then check billing and API usage for unexpected calls.
5. From 28 May 2026, new keys created in AI Studio are authorization keys. If a standard key keeps failing after you restrict it, create a new key and point the server environment at it.

How to check it worked

• The browser's network panel calls your server, not generativelanguage.googleapis.com with the key.
• A server request returns a model response instead of API_KEY_INVALID.
• The key in AI Studio is not labeled Unrestricted or Blocked.

A 429 after the key works is Anthropic or Gemini API 429 and overloaded errors.

Sources

• https://ai.google.dev/gemini-api/docs/generate-content/api-errors (opens in a new tab)
• https://ai.google.dev/gemini-api/docs/api-key (opens in a new tab)