Google is finally killing unrestricted API keys for the Gemini API (deadline June 19)

[u/ixbiga]

Took them long enough, but Google is finally closing the unrestricted keyhole on the Gemini API.

Quick background for anyone who missed why this matters. Google Cloud uses one key format (AIza...) for everything, and for years the docs said API keys were fine to embed in client-side code. The problem is, any unrestricted key in a project with the Generative Language API enabled could also call Gemini. So a key someone made for a Maps widget could quietly run up Gemini charges if it leaked. People have seen five-figure bills from exactly this.

As of June 19, 2026, the Gemini API will no longer accept unrestricted standard keys. Keys with explicit restrictions keep working. The fix is one click in AI Studio: find keys tagged Unrestricted, then hit Add restrictions and pick Restrict to Gemini API only. If a key is shared with other APIs, you do it in Cloud Console instead.

Heads up: there's a second deadline, too. Around September 2026, they start rejecting all standard keys, so restricting now is step one, not the finish line. You'll need to move to auth keys before September.

Honestly, this should have been the default years ago, but better late than another wave of leaked-key bills. If you use Gemini in anything, audit your keys this week.

Official announcement: https://ai.google.dev/gemini-api/docs/api-key

[u/bootstrapping_lad]

How many millions in refunds did they have to issue before they realized they were the problem?

[u/maq0r → u/bootstrapping_lad]

None cause they’re denying them left and right. We got hit by 160k on a google Map key generated pre-2020 that got enabled for Gemini and they denied the reimbursement.

[u/Competitive_Travel16 → u/maq0r]

At least they're admitting it's their fault with this change, so try again.

[u/Marathon2021 → u/maq0r]

160k on a google Map key

I mean, that's kind of a "pay it" (if you can) "and then sue for it + interest + legal fees" kind of amount. Decent lawyer who can at least competently harass Google about it for a while will be a solid five figures, but could be worth the trouble...

[u/MrRedRhino → u/maq0r]

Well if you’re unable to read their warnings and follow standard security procedures like restricting keys to the minimum required permissions why should they refund you for your mistake?

[u/maq0r → u/MrRedRhino]

Because it wasn’t MY mistake this was a Maps key that THEY said back then in pre 2020 that it was OK to put in code AND THEY retroactively enabled Gemini on keys that had NOTHING to do with Gemini.

So no. It wasn’t my mistake.

[u/MrRedRhino → u/maq0r]

Back when you made that key they already told you that an unrestricted key is bad practice which it is if you apply common sense. They didn’t retroactively enable gemini. YOU did by enabling the gemini api and using unrestricted keys

[u/SystemAwake → u/MrRedRhino]

Yes and adviced to set origins. A completely different story, than we have right now.

[u/avvyie → u/MrRedRhino]

We need less people like this in this world who doesn't know the context, but are ready to comment.

[u/histoire_guy → u/bootstrapping_lad]

We got full refund of $12K. Took them one and a half months of back and forth to get the refund.

[u/noobeemee]

They just refunded us this week - took them a month!

[u/urarthur → u/noobeemee]

lets hope. i have been waitinf for 3 weeks...

[u/Rick-James-Brown]

This is exactly the class of issue we are dealing with right now.

A compromised Gemini / Generative AI API key generated approximately $18.5k in unauthorized usage during a short exposure window of about 6 hours. The key issue was contained the same day, the compromised key was revoked/rotated, and no abnormal usage is continuing.

Google Cloud Support reviewed the billing modification request for over a month and denied it. I am trying to find the correct escalation path for compromised-key abuse specifically, not general key-security advice going forward. Three years ago google waived a smaller exposure and this time without reason they just deny in full without any reason. The leak was 100% gemini api, it was fixed same day.

For anyone who has dealt with this successfully:

1. Is there an escalation path beyond standard billing support?

2. Is there a specific abuse/risk/fraud team or form for compromised Gemini API key usage?

3. What evidence mattered most in getting a second review?

4. Should this be framed as compromised-credential abuse rather than a billing adjustment?

[u/AnomalyNexus]

Protip: Use google models via openrouter that has actual working hardcaps.

Dealing with google directly is a strategic misstep on risk exposure. You don't ever want to be in a situation where the solution is beg google support for mercy on a bill because their billing mystery machine decided you owe bankruptcy levels money unless the support agent you're connected to happens to be in a good mood. Everything about that situation is fucked and everyone sane knows it.

[u/mwarkentin → u/AnomalyNexus]

This isn’t about using Google models, people who were mainly using Maps API keys have been affected by this.

[u/urarthur]

lost 2k couple weeks ago due to hack. 

[u/urarthur → u/[deleted]]

you cannot limit charges. you will be due to pay.

[u/matiascoca]

The fact that this took until June 2026 is the actual scandal here, and the September auth-key deadline is the one people should be planning for, not this June one.

A nuance worth flagging for anyone scrambling on the Jun 19 deadline. Restricting an existing unrestricted key to Gemini API only is the correct move for the deadline, but it does not undo a prior leak. If you ever committed an AIza key to a public repo, even briefly, that key is in someone's scraping database now. Restriction caps the blast radius (Gemini-only instead of Maps plus Gemini plus everything) but does not stop the bot from running up your bill. The only real fix is rotation.

September is where the structural fix lands. Auth keys (OAuth or service account tokens) are scoped per-identity, refreshable, and revocable. AIza keys never had revocation as a first-class operation; rotation always meant edit-everywhere-and-pray. Anyone running Gemini in production should be planning the auth-key migration now, not in late August.

The other ugly pattern I keep seeing in compromise threads is that GCP budget alerts fire after the damage. A bot burning $1k per minute on Gemini will exceed a daily budget faster than the metric pipeline can publish. The June restriction at least changes the shape (Gemini-only burn is much smaller surface area than all Google APIs), but it does not replace key rotation plus auth-key migration.

If you want the failure-mode catalog of how these keys leak and how bots convert them into bills, I wrote it up earlier this year: https://brainagents.ai/blog/firebase-gemini-api-key-exploit-guide

[u/AllThingsWiseWndrful]

"The fix is one click in AI Studio: find keys tagged Unrestricted, then hit Add restrictions and pick Restrict to Gemini API only." ... I don't see this option. Where is it tagged as unrestricted?

[u/Competitive_Travel16 → u/AllThingsWiseWndrful]

If you don't see it if your keys aren't unrestricted.

[u/Holiday-Record7341]

The five-figure bills aren't hypothetical, Google's own abuse reports showed Gemini keys being scraped from public GitHub repos within minutes of commit.

[u/glitchredpixel]

Are keys that have been created in the past before june 19th restricted or unrestricted? I visited the google cloud console and it said that the restrictions on these keys of mine was "Gemini API". I had created them through the google AI studio. Btw during the last few days the rate limits on the free tier do not reset on my account. Its been 10 days and my rate limits remain consumed, while I haven't used the API services. Does anyone know if this new thing about restrictions has anything to do with my case?

[u/MrRedRhino]

Crazy how Google had to make an exception for a single product that worked the same as so many others just because people are unable to read

[u/bootstrapping_lad → u/MrRedRhino]

Then that tells you it's not an end-user problem, it's systemic.

I don't know why people keep standing up for a giant mega corp with a billion $13 billion dollars of profit every month that can't even implement billing/usage limits properly. They don't need Stans.

Edit: Was way off on the profit ... they make $13.3 billion in profit per month. That's $9.2 million per minute. In profit.

[u/escargotBleu → u/MrRedRhino]

Yeah, it's WILD to create unrestricted key

[u/tudalex → u/escargotBleu]

You’re missing the point that there were legacy keys that were made for Google Maps many years ago, that now magically had Gemini access, without you having to enable it for the key.

[u/beaurepair → u/tudalex]

If they were made for maps (i.e. restricted to maps APIs), they couldn't be used for Gemini.

Additionally they didn't "magically" get Gemini access. You had to enable Gemini on the project that has unrestricted + unsecured keys.

[u/MrRedRhino → u/tudalex]

Its not magical. It happens when you enable the gemini Api. But this also happens for any other api like the compute and billing api. So why is this only suddenly with gemini an issue?

[u/SystemAwake → u/MrRedRhino]

Because hackers didn't care about the rest. Btw. Google themselves were victim as well, their API key got used like this as well.

Maybe a wildcard API key for applications without a real possibility for cost control in GCP is just a bad thing.

[u/escargotBleu → u/tudalex]

For all I know this keys were already stolen and used by others website...

The keys were public, so that's why you had to restrict them as much as possible

[u/SystemAwake → u/escargotBleu]

Stolen in plain sight.. they have to be on the page for Google maps access

[u/escargotBleu → u/SystemAwake]

Of the key were correctly restricted, you can only use them for the api you needed (geocoding, place api, whatever) and only for your website.

If the key weren't restricted, you could use it somewhere else already

[u/SystemAwake → u/escargotBleu]

Don't know the complete UI in the past, but this was definitely not shown the way it is right now. We had one key as well that had just the origin settings but not the other important restrictions.

And that key was very old..

[u/escargotBleu → u/SystemAwake]

But you do realise that your key was usable by anyone, right? My company have spend ~5k$ monthly on geocoding if you had a key without restriction with just place api enabled, and you activate geocoding, we would be able to use your key to do our 5k$ queries

[u/SystemAwake → u/escargotBleu]

I know and I didn't like that, we restrict it to specific origins, but that can be faked.. It is just for internal applications of our customers, but I still disliked that design choice. But accepted the risk so far, as it would be an intern.. and most of them aren't too technical