Gemini API Standard Keys End in September 2026: A BYOK Migration Checklist
Google says the Gemini API will reject Standard keys in September 2026. Inventory, test, cut over, monitor, and revoke each credential without exposing it.
Direct answer: Audit every Gemini API integration now. Google says the Gemini API will reject Standard API keys in September 2026, while new keys created in Google AI Studio are authorization keys tied to a service account. A safe migration replaces each key in a controlled release, verifies the real application path, and revokes the old credential only after rollback is no longer needed.
This is especially important for browser tools that ask users to bring their own key. A working Standard key today is not evidence that the same request will work after the September cutoff.
Identify the key type and request path
Open Google AI Studio, import the relevant Cloud projects if necessary, and inspect the Key Type column. Record the application, environment, owner, key type, storage location, model endpoint, billing project, and allowed request origin. Do not paste the credential into the inventory.
| Field | Record | Do not record |
|---|---|---|
| Credential | Internal alias and key type | Raw key value |
| Application | Tool, environment and owner | Unrelated private data |
| Request | Endpoint, model and origin | User prompts or secrets |
| Release | Test, cutover and rollback time | An unverified success claim |
Trace the complete request path. A key may live in a server environment variable, deployment secret, plugin option, CI system, local development file, or user-controlled browser storage. Searching one code repository is not a complete inventory.
Create the auth key with the right owner
Google documents authorization keys as credentials bound to a service account and restricted to the Gemini API by default. Confirm who owns that service account, which project pays for usage, who can rotate the key, and which environments are permitted to use it.
For a production website, do not hardcode the key in shipped JavaScript. Google explicitly advises against exposing keys client-side because a user can extract them. Use a backend proxy for a publisher-owned key. A true BYOK tool can keep the visitor’s credential in the browser, but the interface should explain storage, network behavior, removal, and the difference between local retention and requests sent to Google.
Google also notes that auth-key requests are not recorded in Cloud service-account usage metrics. Preserve a separate application-level request ledger or billing observation so the migration does not silently remove a monitoring signal your team depended on.
Test before cutover
- Create the auth key in the intended project and store it in the approved secret location.
- Run one low-risk request through the same SDK, endpoint, model, region, proxy and deployment path used in production.
- Confirm the response, status, quota behavior, logging, billing visibility and error handling.
- Deploy the new key to one controlled environment and watch for authentication, permission and origin failures.
- Keep the old key available only for the declared rollback window.
- After verification, revoke or delete the Standard key and record the action.
A test from AI Studio is not enough when the live tool uses a different project, runtime or network path. Save the test timestamp and response metadata, not the prompt content when it contains user data.
Set a release gate
The migration is complete when every active integration has an accountable owner, auth-key evidence, a successful production-path test, a monitoring plan, and a revoked Standard key. Dormant tools should be removed or explicitly retired rather than left with credentials nobody owns.
Google’s current documentation gives September 2026 as the cutoff but does not name a day. Treat the month as a deadline boundary, not permission to wait until its final week. Reopen the documentation before release in case the schedule or instructions change.
Use the technical launch checklist for the surrounding deployment and the tool decision framework to record why the integration remains necessary.
Ask a question or join the discussion