How to rotate your Google Gemini API key

Updated October 2026

A Google Gemini API key can be created and deleted through Google's own API, but the create call doesn't hand you the key. It hands you a long-running Operation, and you fetch the actual value in a second call once that finishes.

Here's the exact process, from Google's own docs.

The manual steps

1. Create the key: POST https://apikeys.googleapis.com/v2/projects/{project}/locations/global/keys, with a service account token scoped https://www.googleapis.com/auth/cloud-platform. Google's own API reference, checked November 27, 2026, confirms global is the only valid location and the response is an Operation object, not the key string.
2. Wait for that Operation to finish, then fetch the real value: GET https://apikeys.googleapis.com/v2/{name}/keyString, which returns {"keyString": "AIza..."}. Google's own docs list this as a separate call on purpose, gated by its own apikeys.keys.getKeyString permission.
3. Lock the new key to the Gemini API so it can't be used anywhere else: set restrictions.apiTargets to generativelanguage.googleapis.com in the create request.
4. Swap the new key into every place the old one lived, then confirm it works.
5. Delete the old key: DELETE https://apikeys.googleapis.com/v2/{name}.

What breaks if you miss a place

Google's own docs describe the delete as a soft delete, the same pattern used across GCP's API Keys product, with an undelete method listed. That's good news if you delete the wrong key by mistake. It's also a reason not to assume a deleted key stops a determined script immediately. Treat it as gone for planning purposes, and don't build anything that depends on the exact recovery window without checking the console for your project.

How to check the old key is actually dead

Call GET https://generativelanguage.googleapis.com/v1beta/models?key=<key> with the old key. It only lists models, so testing costs nothing. Google's documented general pattern for an invalid API key is a 400 with reason API_KEY_INVALID in the error details. One honest gap: we could not confirm that exact status directly against a deliberately deleted Gemini key in the official docs we checked November 27, 2026, so confirm it once against a real project before trusting it in automated code.

Why the restriction step matters more than usual

An unrestricted Gemini key works against any Google API the project has enabled, not just Gemini. Google's own guidance notes that keys created after May 28, 2026 are set up as auth keys by default, and an unrestricted key can be rejected by some endpoints outright. Setting apiTargets at creation is the one step that turns a general-purpose credential into one that can only ever call the model API.

Or let Key Robot do it

Key Robot does this for you today, with a Google Cloud service account you make once. It makes the new key, locked to the Gemini API only, fetches its value, puts it in your app, checks your app still works, and then deletes the old key. Google takes a few seconds to switch a deleted key off, so the robot keeps asking until the old key is refused.

In our live test on October 26, 2026, one change took 6 seconds. On a deployed Railway app, a change took 19 seconds with the redeploy, and the undo worked when the app refused the next key.

See how to rotate your OpenAI key for another AI provider the robot handles, or the rotate hub for every service.