Developer Lab Practical application development
without unnecessary complexity.
← Course Dashboard
Course › Getting Started › Lesson 3
📖 Lesson 🕒 15 minutes
03
Getting Started

Creating an API Key

Create and safely manage a Gemini API key.

What Is an API Key?

An API key is a private credential that allows your application to send authorized requests to the Gemini API.

When your application sends a request, the API key tells Google which project is making the request. That project is then used to manage access, usage limits, and billing when applicable.

Think of the key as an application credential

The key does not represent the person typing into your application. It represents the project and application communicating with Gemini.

The Key Is Not Your Google Password

Your Gemini API key is separate from the password used to sign into your Google account.

However, it must still be treated as sensitive because someone who obtains the key may be able to make API requests through your project.

Never share your real API key

Do not paste your key into course exercises, community posts, screenshots, public repositories, support messages, or browser-based JavaScript.

The Project and Key Relationship

Every Gemini API key is connected to a Google Cloud project.

The project acts as the container for:

  • Your API keys
  • Usage information
  • Rate limits
  • Permissions
  • Collaborators
  • Billing settings when enabled

One Google account may have access to several projects. Each project can represent a separate application, business, client, or development environment.

A useful organizational habit

Use clearly named projects rather than placing every application inside one generic project.

For example: 

Business Email Assistant
Document Analysis Application
Image Description Tool
Development Testing

Open the API Keys Dashboard

Open the Google AI Studio API Keys dashboard in a separate browser tab.

Open API Keys Dashboard ↗

The interface may change

Google regularly updates AI Studio. The exact placement or wording of buttons may change, but you should still find an API Keys area containing your projects, keys, key types, status, and creation controls.

New AI Studio Users

When a new user accepts the Google AI Studio terms, AI Studio may automatically create a default Google Cloud project and Gemini API key.

In that case, you may already see a key listed when you open the API Keys dashboard.

You can use that project for the course or create a separate project with a more descriptive name.

Users With Existing Google Cloud Projects

If your Google account already uses Google Cloud, AI Studio may not automatically display every project associated with the account.

You may need to import the project into AI Studio:

  1. Open the AI Studio Dashboard.
  2. Select Projects.
  3. Select Import projects.
  4. Search for the Google Cloud project.
  5. Select the project and import it.
  6. Return to the API Keys area.

Importing a project into AI Studio does not create a duplicate. It makes the existing project visible in the AI Studio interface.

Create a New API Key

The current creation process generally follows these steps:

  1. Open the AI Studio API Keys dashboard.
  2. Select Create API key.
  3. Select the Google Cloud project that should own the key.
  4. Confirm the key creation.
  5. Copy the generated key and place it in a secure location.

Do not paste the key into this course

This lesson only teaches you how to create and protect the credential. Our application will read the key securely from the server in a later step.

Understanding Key Types

You may see a Key Type column in AI Studio. Current Gemini API keys may be listed as either authorization keys or older standard keys.

Authorization Key

New API keys created through Google AI Studio are normally authorization keys.

These keys are designed specifically for more secure Gemini API authentication and are restricted to the Gemini API by default.

Standard Key

Standard Google API keys are the older key type. They associate requests with a Google Cloud project but provide fewer identity and access-control capabilities.

Google is transitioning Gemini API access away from standard keys. When creating a new application, use the current key type generated by AI Studio rather than attempting to create an older key.

Keep this simple

You do not need to manually choose the key technology for this course. Create the key through AI Studio and use the current default it provides.

What an API Key Looks Like

An API key is a long string of letters, numbers, and symbols.

A fictional example might look like: 

example_key_7Fx39AbC2dE8_not_a_real_key

This is intentionally fake

Never place a working key inside lesson content, sample code, screenshots, or documentation.

How the Key Is Sent to Gemini

When your server makes a Gemini API request, it includes the API key in an HTTP request header.

The header concept looks like: 

x-goog-api-key: YOUR_API_KEY

The key authorizes the request before Gemini processes the supplied content.

In the next lesson, PHP will build the request, attach the key securely, send the request, and read the response.

Where Should the Key Be Stored?

The safest general practice is to store the API key outside the publicly accessible application code.

A common method is an environment variable: 

GEMINI_API_KEY=your_private_key

PHP can then read it without placing the actual credential in the application file: 

<?php

$apiKey = getenv('GEMINI_API_KEY');

if (!$apiKey) {
    exit('Gemini API key is not configured.');
}

The source code contains the name of the environment variable, but it does not contain the private key itself.

Temporary Terminal Environment Variables

On macOS or Linux, a temporary environment variable can be set in a terminal session with: 

export GEMINI_API_KEY="YOUR_PRIVATE_KEY"

The value normally remains available only during that terminal session.

A persistent environment variable can be added to the appropriate shell configuration file, such as: 

~/.zshrc
~/.bashrc

After saving the configuration, the terminal environment must be reloaded or reopened.

Shared Hosting and cPanel

Hosting environments do not all manage environment variables in the same way.

Depending on the hosting provider, the key may be stored through:

  • A hosting control-panel environment-variable setting
  • A server configuration file outside the public web directory
  • A protected PHP configuration file
  • A server-side secret-management system

The important rule is that the browser should never receive the private key.

Server-side does not automatically mean secure

A PHP file can still be exposed through backups, incorrect server configuration, downloadable files, public repositories, or error messages. The key must be stored deliberately and protected from direct access.

What Not to Do

Do not place the key in browser JavaScript

// Do not do this

const apiKey = "your_real_private_key";

Visitors can inspect downloaded JavaScript, browser requests, and page source.

Do not place the key in HTML

<input type="hidden" value="your_real_private_key">

Hidden form fields are hidden visually, not protected.

Do not include the key in a public repository

$apiKey = "your_real_private_key";

Removing a key from the newest version of a file may not remove it from the repository's earlier history.

Do not send the key through a URL

https://example.com/tool.php?api_key=your_real_private_key

URLs may be stored in browser history, server logs, analytics systems, and referrer information.

Do not expose the key in an error message

Error using key: your_real_private_key

Application errors should describe the problem without printing credentials.

Development Key Versus Production Key

A useful security practice is to use separate keys for development and production.

Development Key

  • Used while building and testing
  • Connected to a development project
  • May have lower usage limits
  • Can be replaced without affecting customers

Production Key

  • Used by the live application
  • Connected to the production project
  • Monitored more closely
  • Accessible only by the production server

Separating the two environments helps prevent testing mistakes from affecting the live application.

API Keys and Billing

Creating an API key does not automatically mean that every request will be billed.

Google may provide a free usage tier with model-specific rate limits. Paid access can provide higher limits or access to additional capabilities.

Before enabling billing:

  • Review the current model pricing
  • Review the current rate limits
  • Understand which project owns the key
  • Monitor the project's usage
  • Use application-level usage controls

An API key is not a spending limit

The key permits requests. Your application still needs its own usage tracking, credit limits, rate controls, and error handling.

Monitor API Usage

Google AI Studio provides a Usage area where you can review API activity associated with your projects.

Regular monitoring can help identify:

  • Unexpected increases in requests
  • An application loop
  • Incorrect model usage
  • Possible unauthorized activity
  • Changes in normal customer behavior

Usage monitoring should be combined with tracking inside your own application.

What to Do if a Key Is Exposed

Treat a publicly exposed key as compromised, even if you do not see any unauthorized usage yet.

  1. Create a replacement key.
  2. Update the application or server environment to use the replacement.
  3. Test the application and confirm that the replacement works.
  4. Disable or revoke the exposed key.
  5. Review project usage and billing activity.
  6. Find and correct the location where the key was exposed.

Keys are replaceable

Replacing a compromised key is inconvenient, but it is much safer than continuing to use a credential that may be known by someone else.

Permission Errors

You may see a message explaining that you do not have permission to create a key in a selected project.

This usually means that your Google account does not have the required project permissions.

Possible solutions include:

  • Selecting a project you own
  • Creating a separate project
  • Asking the project administrator for permission
  • Using the default AI Studio project

Do not attempt to work around organizational security controls. Use a project where you have been granted the appropriate access.

Blocked or Nonworking Keys

Google may block a key that has been publicly exposed, reported as leaked, incorrectly configured, or left in an insecure state.

If a key stops working:

  1. Check its status in the AI Studio API Keys dashboard.
  2. Confirm that the correct project is selected.
  3. Confirm that the key has not been disabled or revoked.
  4. Confirm that the application is loading the intended key.
  5. Create a replacement key when necessary.

Do not repeatedly publish or reuse a key that Google has identified as leaked.

Practical Exercise

Complete the following without entering your private key into this course:

  1. Open the AI Studio API Keys dashboard.
  2. Identify the Google Cloud project you will use for the course.
  3. Create a new key or locate the key AI Studio created for you.
  4. Check the key's type and current status.
  5. Copy the key into a secure temporary location.
  6. Decide where the key will eventually be stored on your server.
  7. Open the AI Studio Usage area and become familiar with its location.

Do not submit the key as proof

You never need to send an instructor, application owner, support person, or community member your complete API key to prove that you created it.

Official Resources

Key-management behavior can change, so use Google's current documentation when the AI Studio interface differs from this lesson.

Gemini API Key Documentation ↗

Gemini API Troubleshooting Guide ↗

Lesson Summary

A Gemini API key authorizes your application to send requests through a Google Cloud project. The project manages permissions, usage, limits, and billing when applicable.

The key must remain on the server and should never be delivered to the user's browser, embedded in public code, included in URLs, or shared through screenshots and messages.

You now have the credential required to communicate with Gemini. In the next lesson, we will use PHP to send the first real API request and display Gemini's response.