How to Configure Authentication for the Gemini API on Google Cloud Agent Platform

Configure Gemini API authentication using Application Default Credentials (ADC) for production workloads or Express Mode (API key) for quick prototyping, both requiring the GOOGLE_GENAI_USE_ENTERPRISE=true environment variable.

The Gemini API within the Google Cloud Agent Platform offers two distinct authentication pathways tailored to different deployment scenarios. Understanding how to configure authentication for Gemini API correctly ensures secure, scalable access to Google's generative AI capabilities through the unified Gen AI SDK.

Two Authentication Modes for Gemini API

The skills/cloud/gemini-api/SKILL.md file defines two primary authentication approaches. Your environment and security requirements determine which to use.

Application Default Credentials (ADC)

ADC is the recommended production authentication method. The client library automatically discovers credentials through Google's standard authentication flow.

Required environment variables:

• GOOGLE_CLOUD_PROJECT — your Google Cloud project ID
• GOOGLE_CLOUD_LOCATION — region (e.g., global, us-central1)
• GOOGLE_GENAI_USE_ENTERPRISE=true — enables enterprise backend routing

The SDK reads these variables at runtime and constructs OAuth tokens from the attached service account. No API key management required.

Security advantages of ADC:

• Short-lived tokens — OAuth tokens expire automatically, unlike long-lived API keys
• Least-privilege IAM — scope permissions precisely using roles like aiplatform.models.predict
• Automatic rotation — token refresh happens transparently without code changes

When to use ADC:

• Workloads running on Cloud Run, GKE, or Compute Engine
• Local development with gcloud auth application-default login
• Any production environment where service accounts can be attached

Express Mode (API Key)

Express Mode provides lightweight key-based authentication when ADC infrastructure isn't available.

Required environment variables:

• GOOGLE_API_KEY — API key from Google Cloud Console → APIs & Services → Credentials
• GOOGLE_GENAI_USE_ENTERPRISE=true

The SDK sends the key in the Authorization: Bearer <API-key> request header.

When to use Express Mode:

• Quick prototyping without service account setup
• Client-side or edge-runtime scenarios
• Testing environments where gcloud authentication is impractical

Code Examples by Language

Python: ADC Authentication

export GOOGLE_CLOUD_PROJECT='my-project'
export GOOGLE_CLOUD_LOCATION='global'
export GOOGLE_GENAI_USE_ENTERPRISE=true

from google import genai

client = genai.Client()  # No arguments—picks up ADC automatically

response = client.models.generate_content(
    model="gemini-3.6-flash",
    contents="Explain quantum computing"
)
print(response.text)

Python: Express Mode

export GOOGLE_API_KEY='YOUR_API_KEY'
export GOOGLE_GENAI_USE_ENTERPRISE=true

from google import genai

client = genai.Client()  # Reads GOOGLE_API_KEY automatically

response = client.models.generate_content(
    model="gemini-3.6-flash",
    contents="Explain quantum computing"
)
print(response.text)

TypeScript: ADC Authentication

export GOOGLE_CLOUD_PROJECT='my-project'
export GOOGLE_CLOUD_LOCATION='global'
export GOOGLE_GENAI_USE_ENTERPRISE=true

import { GoogleGenAI } from "@google/genai";

const ai = new GoogleGenAI({
  enterprise: { project: "my-project", location: "global" }
});

const resp = await ai.models.generateContent({
  model: "gemini-3.6-flash",
  contents: "Explain quantum computing"
});
console.log(resp.text);

TypeScript: Express Mode

export GOOGLE_API_KEY='YOUR_API_KEY'
export GOOGLE_GENAI_USE_ENTERPRISE=true

import { GoogleGenAI } from "@google/genai";

const ai = new GoogleGenAI();  // No project needed—SDK uses API key

const resp = await ai.models.generateContent({
  model: "gemini-3.6-flash",
  contents: "Explain quantum computing"
});
console.log(resp.text);

Go: ADC Authentication

export GOOGLE_CLOUD_PROJECT='my-project'
export GOOGLE_CLOUD_LOCATION='global'
export GOOGLE_GENAI_USE_ENTERPRISE=true

package main

import (
    "context"
    "fmt"
    "log"
    "google.golang.org/genai"
)

func main() {
    ctx := context.Background()
    client, err := genai.NewClient(ctx, &genai.ClientConfig{
        Backend:  genai.BackendVertexAI,
        Project:  "my-project",
        Location: "global",
    })
    if err != nil {
        log.Fatal(err)
    }
    resp, err := client.Models.GenerateContent(
        ctx,
        "gemini-3.6-flash",
        genai.Text("Explain quantum computing"),
        nil,
    )
    if err != nil {
        log.Fatal(err)
    }
    fmt.Println(resp.Text)
}

Go: Express Mode

export GOOGLE_API_KEY='YOUR_API_KEY'
export GOOGLE_GENAI_USE_ENTERPRISE=true

The Go SDK detects GOOGLE_API_KEY automatically—use the same client initialization code as ADC.

Supported Gen AI SDKs

The authentication patterns above apply across the unified SDK family:

Language	Package
Python	google-genai
JavaScript/TypeScript	@google/genai
Go	google.golang.org/genai
.NET	Google.GenAI
Java	com.google.genai:google-genai

All SDKs share identical environment variable conventions and initialization behavior for how to configure authentication for Gemini API.

Key Source Files in google/skills

• skills/cloud/gemini-api/SKILL.md — Master skill definition detailing authentication modes, SDK usage, and model selection [source]

• skills/cloud/gemini-live-api/references/session_manager.md — Demonstrates header construction for live API sessions (Authorization: Bearer <token>) [source]

• skills/cloud/gemini-agents-api/SKILL.md — Documents optional custom headers for agent-specific authentication [source]

Summary

• Always set GOOGLE_GENAI_USE_ENTERPRISE=true — required for both authentication modes
• Prefer ADC for production — superior security through OAuth tokens, IAM scoping, and automatic rotation
• Use Express Mode only when necessary — API keys suit prototyping, client-side code, or environments without service account support
• SDK handles credential construction — initialize with genai.Client() (Python), new GoogleGenAI() (TypeScript), or genai.NewClient() (Go) and let environment variables drive behavior

Frequently Asked Questions

What happens if I set both GOOGLE_API_KEY and ADC variables?

The SDK prioritizes based on context. According to skills/cloud/gemini-api/SKILL.md, explicit project configuration in the client constructor typically triggers ADC path, while absence of project configuration with GOOGLE_API_KEY present selects Express Mode. To avoid ambiguity, use only one authentication path per deployment.

Is GOOGLE_GENAI_USE_ENTERPRISE required for Gemini API authentication?

Yes. Both ADC and Express Mode require GOOGLE_GENAI_USE_ENTERPRISE=true to route requests through the enterprise backend. This flag distinguishes Agent Platform usage from consumer Gemini API access.

How do I rotate credentials in a running production service?

With ADC, rotation happens automatically—OAuth tokens refresh before expiration without service restart. For Express Mode, you must update the GOOGLE_API_KEY environment variable and restart the process. This operational difference makes ADC strongly preferred for production.

Can I use Gemini API authentication outside Google Cloud?

Yes. Express Mode with GOOGLE_API_KEY works from any environment. For ADC outside Google Cloud, run gcloud auth application-default login to establish local credentials, or provide a service account key file via GOOGLE_APPLICATION_CREDENTIALS environment variable.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}