# How to Configure Authentication for the Gemini API on Google Cloud Agent Platform

> Learn to configure Gemini API authentication on Google Cloud Agent Platform. Use ADC for production or API keys for prototyping, setting GOOGLE_GENAI_USE_ENTERPRISE=true.

- Repository: [Google/skills](https://github.com/google/skills)
- Tags: how-to-guide
- Published: 2026-08-15

---

**Configure Gemini API authentication using Application Default Credentials (ADC) for production workloads or Express Mode (API key) for quick prototyping, both requiring the `GOOGLE_GENAI_USE_ENTERPRISE=true` environment variable.**

The Gemini API within the Google Cloud Agent Platform offers two distinct authentication pathways tailored to different deployment scenarios. Understanding how to configure authentication for Gemini API correctly ensures secure, scalable access to Google's generative AI capabilities through the unified Gen AI SDK.

## Two Authentication Modes for Gemini API

The [`skills/cloud/gemini-api/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gemini-api/SKILL.md) file defines two primary authentication approaches. Your environment and security requirements determine which to use.

### Application Default Credentials (ADC)

**ADC is the recommended production authentication method.** The client library automatically discovers credentials through Google's standard authentication flow.

**Required environment variables:**

- `GOOGLE_CLOUD_PROJECT` — your Google Cloud project ID
- `GOOGLE_CLOUD_LOCATION` — region (e.g., `global`, `us-central1`)
- `GOOGLE_GENAI_USE_ENTERPRISE=true` — enables enterprise backend routing

The SDK reads these variables at runtime and constructs OAuth tokens from the attached service account. No API key management required.

**Security advantages of ADC:**

- **Short-lived tokens** — OAuth tokens expire automatically, unlike long-lived API keys
- **Least-privilege IAM** — scope permissions precisely using roles like `aiplatform.models.predict`
- **Automatic rotation** — token refresh happens transparently without code changes

**When to use ADC:**

- Workloads running on Cloud Run, GKE, or Compute Engine
- Local development with `gcloud auth application-default login`
- Any production environment where service accounts can be attached

### Express Mode (API Key)

**Express Mode provides lightweight key-based authentication** when ADC infrastructure isn't available.

**Required environment variables:**

- `GOOGLE_API_KEY` — API key from Google Cloud Console → APIs & Services → Credentials
- `GOOGLE_GENAI_USE_ENTERPRISE=true`

The SDK sends the key in the `Authorization: Bearer <API-key>` request header.

**When to use Express Mode:**

- Quick prototyping without service account setup
- Client-side or edge-runtime scenarios
- Testing environments where `gcloud` authentication is impractical

## Code Examples by Language

### Python: ADC Authentication

```bash
export GOOGLE_CLOUD_PROJECT='my-project'
export GOOGLE_CLOUD_LOCATION='global'
export GOOGLE_GENAI_USE_ENTERPRISE=true

```

```python
from google import genai

client = genai.Client()  # No arguments—picks up ADC automatically

response = client.models.generate_content(
    model="gemini-3.6-flash",
    contents="Explain quantum computing"
)
print(response.text)

```

### Python: Express Mode

```bash
export GOOGLE_API_KEY='YOUR_API_KEY'
export GOOGLE_GENAI_USE_ENTERPRISE=true

```

```python
from google import genai

client = genai.Client()  # Reads GOOGLE_API_KEY automatically

response = client.models.generate_content(
    model="gemini-3.6-flash",
    contents="Explain quantum computing"
)
print(response.text)

```

### TypeScript: ADC Authentication

```bash
export GOOGLE_CLOUD_PROJECT='my-project'
export GOOGLE_CLOUD_LOCATION='global'
export GOOGLE_GENAI_USE_ENTERPRISE=true

```

```typescript
import { GoogleGenAI } from "@google/genai";

const ai = new GoogleGenAI({
  enterprise: { project: "my-project", location: "global" }
});

const resp = await ai.models.generateContent({
  model: "gemini-3.6-flash",
  contents: "Explain quantum computing"
});
console.log(resp.text);

```

### TypeScript: Express Mode

```bash
export GOOGLE_API_KEY='YOUR_API_KEY'
export GOOGLE_GENAI_USE_ENTERPRISE=true

```

```typescript
import { GoogleGenAI } from "@google/genai";

const ai = new GoogleGenAI();  // No project needed—SDK uses API key

const resp = await ai.models.generateContent({
  model: "gemini-3.6-flash",
  contents: "Explain quantum computing"
});
console.log(resp.text);

```

### Go: ADC Authentication

```bash
export GOOGLE_CLOUD_PROJECT='my-project'
export GOOGLE_CLOUD_LOCATION='global'
export GOOGLE_GENAI_USE_ENTERPRISE=true

```

```go
package main

import (
    "context"
    "fmt"
    "log"
    "google.golang.org/genai"
)

func main() {
    ctx := context.Background()
    client, err := genai.NewClient(ctx, &genai.ClientConfig{
        Backend:  genai.BackendVertexAI,
        Project:  "my-project",
        Location: "global",
    })
    if err != nil {
        log.Fatal(err)
    }
    resp, err := client.Models.GenerateContent(
        ctx,
        "gemini-3.6-flash",
        genai.Text("Explain quantum computing"),
        nil,
    )
    if err != nil {
        log.Fatal(err)
    }
    fmt.Println(resp.Text)
}

```

### Go: Express Mode

```bash
export GOOGLE_API_KEY='YOUR_API_KEY'
export GOOGLE_GENAI_USE_ENTERPRISE=true

```

The Go SDK detects `GOOGLE_API_KEY` automatically—use the same client initialization code as ADC.

## Supported Gen AI SDKs

The authentication patterns above apply across the unified SDK family:

| Language | Package |
|----------|---------|
| Python | `google-genai` |
| JavaScript/TypeScript | `@google/genai` |
| Go | `google.golang.org/genai` |
| .NET | `Google.GenAI` |
| Java | `com.google.genai:google-genai` |

All SDKs share identical environment variable conventions and initialization behavior for how to configure authentication for Gemini API.

## Key Source Files in google/skills

- **[`skills/cloud/gemini-api/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gemini-api/SKILL.md)** — Master skill definition detailing authentication modes, SDK usage, and model selection [[source]](https://github.com/google/skills/blob/main/skills/cloud/gemini-api/SKILL.md)

- **[`skills/cloud/gemini-live-api/references/session_manager.md`](https://github.com/google/skills/blob/main/skills/cloud/gemini-live-api/references/session_manager.md)** — Demonstrates header construction for live API sessions (`Authorization: Bearer <token>`) [[source]](https://github.com/google/skills/blob/main/skills/cloud/gemini-live-api/references/session_manager.md)

- **[`skills/cloud/gemini-agents-api/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gemini-agents-api/SKILL.md)** — Documents optional custom headers for agent-specific authentication [[source]](https://github.com/google/skills/blob/main/skills/cloud/gemini-agents-api/SKILL.md)

## Summary

- **Always set `GOOGLE_GENAI_USE_ENTERPRISE=true`** — required for both authentication modes
- **Prefer ADC for production** — superior security through OAuth tokens, IAM scoping, and automatic rotation
- **Use Express Mode only when necessary** — API keys suit prototyping, client-side code, or environments without service account support
- **SDK handles credential construction** — initialize with `genai.Client()` (Python), `new GoogleGenAI()` (TypeScript), or `genai.NewClient()` (Go) and let environment variables drive behavior

## Frequently Asked Questions

### What happens if I set both GOOGLE_API_KEY and ADC variables?

The SDK prioritizes based on context. According to [`skills/cloud/gemini-api/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gemini-api/SKILL.md), explicit project configuration in the client constructor typically triggers ADC path, while absence of project configuration with `GOOGLE_API_KEY` present selects Express Mode. To avoid ambiguity, use only one authentication path per deployment.

### Is GOOGLE_GENAI_USE_ENTERPRISE required for Gemini API authentication?

Yes. Both ADC and Express Mode require `GOOGLE_GENAI_USE_ENTERPRISE=true` to route requests through the enterprise backend. This flag distinguishes Agent Platform usage from consumer Gemini API access.

### How do I rotate credentials in a running production service?

With ADC, rotation happens automatically—OAuth tokens refresh before expiration without service restart. For Express Mode, you must update the `GOOGLE_API_KEY` environment variable and restart the process. This operational difference makes ADC strongly preferred for production.

### Can I use Gemini API authentication outside Google Cloud?

Yes. Express Mode with `GOOGLE_API_KEY` works from any environment. For ADC outside Google Cloud, run `gcloud auth application-default login` to establish local credentials, or provide a service account key file via `GOOGLE_APPLICATION_CREDENTIALS` environment variable.