Gemini API Key Migration: Build a 30-Field Cutover Register

Read the current key contract first

Google documents two Gemini API key types. A Standard key associates requests with a Google Cloud project for billing and quota, but does not identify the caller. An authorization key is bound to a service account and processes requests under that identity. New keys created in Google AI Studio now default to authorization keys.

That distinction matters during incident triage. “The old key still works” can describe a restricted Standard key before the cutoff; it does not show that the migration is complete.

Treat September as an active cutover window

Google’s documentation still says Standard keys will be rejected in September 2026, but it does not publish a day or hour. On September 15, the safe operating assumption is that a restricted Standard key can stop working without a more precise public countdown.

If the Standard key is unrestricted

Google documents that Gemini API requests are rejected. Treat this as an incident, not a future migration task.

If it is restricted and still works

That is temporary compatibility, not proof that the September migration is optional.

If the authorization key works only in AI Studio

The production path is not verified. Repeat the request through the actual runtime, proxy, SDK, endpoint and model.

If service-account usage looks empty

Google says authorization-key requests are not recorded in service-account usage metrics. Validate the application telemetry selected for the cutover.

The useful evidence is a pair of timestamped production-path tests with the same low-risk input: one baseline before the switch and one after it. Record status, model, latency, application outcome, quota or billing observation, and rollback decision. Never place the raw credential in the register.

Inventory integrations, not secret strings

Create one row for each application and environment that sends Gemini API requests. Record a stable internal key alias, never the raw key. A single credential reused across production, staging and local development should become separate records because its blast radius and cutover sequence are different.

Search code repositories, deployment secrets, CI variables, plugin settings, server environments and operational runbooks. Google AI Studio shows projects and keys that have been imported into its interface; it is not necessarily a complete map of where each key is used.

Trace the real request path

Write down the route from user action or scheduled job to the Gemini endpoint. Include browser, proxy, runtime, secret store, SDK, endpoint, model and billing project. A successful request in AI Studio validates a different environment from a WordPress plugin, Node service or edge worker.

Freeze the current SDK and model identifier for the migration test. Changing authentication, client library and model in one release makes an error harder to isolate. Move one control at a time unless an urgent security incident makes staged work unsafe.

Choose the service-account owner

An authorization key runs under the identity of its bound service account. Before creating it, name the team that owns that service account, the project that pays for requests, the people allowed to rotate it and the environments allowed to use it. Record the service-account identity, not a downloaded private-key file.

Google lists permissions needed to create and bind authorization keys, including project lookup, API key creation, service activation, service-account creation and service-account API-key binding. If AI Studio reports that key creation is unavailable, solve the IAM ownership problem rather than moving the workload into an unmanaged personal project.

Keep publisher-owned keys off the client

Google says not to hardcode API keys in production web or mobile applications because users can extract them. A publisher-owned key belongs behind a server-side proxy and in a managed secret store. Environment variables are safer than committed configuration files, while a production secret manager adds access control and rotation history.

A bring-your-own-key tool has a different contract: the visitor supplies the credential and the browser sends requests under the visitor’s project. Explain storage duration, network destination, removal and whether the application relays or logs the key. Do not call a publisher-owned key exposed in JavaScript “BYOK.”

Save a baseline before cutover

Run a low-risk request through the existing production path and record the time, HTTP status, endpoint, model, application response, quota behavior and billing observation. Exclude sensitive prompt content. The baseline is useful only if the new-key test repeats the same path and expected result.

If the existing key is unrestricted and already rejected, record that failure rather than inventing a passing baseline. The migration goal then becomes restoration through an authorization key, with the outage window visible.

Test four layers before revocation

Use a staging environment first, then a small production slice where the architecture supports it. Record failures and zero-output cases; deleting them from the migration record makes the release appear safer than it was.

Replace the service-account metric you will lose

Google notes that requests authenticated by authorization keys are not recorded in Google Cloud service-account usage metrics. A new service-account-bound identity therefore does not guarantee a useful service-account usage graph. Preserve application request counts, success and error rates, latency, quota evidence and billing alerts through other supported telemetry.

Write service_account_metric_expected=no in the register rather than treating the missing metric as an outage. Then verify the monitoring source you actually intend to use.

Set a short, explicit rollback window

1. Create the authorization key in the intended project.
2. Store it in the approved secret location.
3. Deploy to the controlled environment.
4. Run the production-path verification.
5. Watch the declared operational metrics.
6. Keep the old key only until the rollback deadline.
7. Disable or delete it and record the revocation time.

Google’s leak-response guidance follows the same safe order: generate a replacement, deploy it, verify it, then disable or delete the compromised key. An indefinite overlap is not a rollback plan; it leaves two active credentials and an unclear owner.

Classify errors by control point

An authentication failure, permission failure, quota error, model error and application parse error require different owners. Save the HTTP status and a privacy-safe error class. Do not paste full responses into a shared spreadsheet when they may contain prompts or account data.

If a key works from one location and fails from another, compare request-origin restrictions, proxy egress, project, endpoint and runtime before regenerating credentials. Rotation without diagnosis can multiply unmanaged keys.

Use the register as a release gate

A row is complete when it names an owner, project, key type, request path, successful production-path test, operational observation, rollback deadline and old-key disposition. “Created new key” is not a release decision. The register forces the team to connect a credential to a working application and a revocation record.

Run the surrounding deployment through the technical launch checklist when the integration affects a public tool. The tool-stack decision framework helps decide whether a dormant integration should be migrated or retired.

Deadline and evidence boundaries

Google’s page says Standard keys will be rejected “on September 2026” and advises migration before September. Because it does not provide a day, treat September as a boundary, not a final-week maintenance window. Reopen the documentation immediately before release.

This guide does not test your account, inspect your credentials or prove that a particular key will fail at a particular minute. It translates Google’s documented contract into a reversible operating record.

Primary documentation

Sources rechecked September 15, 2026: Google AI for Developers’ Gemini API key documentation and Gemini API release notes. Keep Gemini API authentication separate from the Gemini app, Vertex AI credentials and Google Search behavior. More repeatable implementation resources are collected in Tools & Workflows.