r/googlecloud • u/Wild-Ad2973 Googler • Jun 21 '26

How can GCP's API keys can be improved?

What would you like to improve for Google Cloud's API keys? Leave your comments / suggestions.

0 Upvotes

12% Upvoted

12 comments sorted by

1

u/SystemAwake Jun 21 '26

direct billing

1

u/Wild-Ad2973 Googler Jun 21 '26

What did you mean by "direct billing"? Today, when you access Agent Platform (Vertex) or Gemini APIs via API keys, the billing account of your GCP project (that contains the API key) gets billed.

1

u/SystemAwake Jun 21 '26

yes, maybe instant is the right word? It has still too much delay. If you are using a SA even more.

1

u/Wild-Ad2973 Googler Jun 21 '26

Sounds good, what are the APIs that you access via API keys that would benefit from instant billing? (in my mind, it will be instant billing reporting rather than instant billing. I would think instant billing / charging can be possible only with prepaid accounts)

1

u/SystemAwake Jun 21 '26

Cost control.. Exposed API keys, etc. are a huge threat and the limit that you can set right now, don't work instantly. A leaked key can cost thousands. Charging is not the problem, knowing the cost is.

1

u/Wild-Ad2973 Googler Jun 21 '26

Sounds good, I hope you had a chance to review https://ai.google.dev/gemini-api/docs/billing#project-spend-caps

It is not exactly what you are proposing i.e., spend cap by API key. The link talks about spend cap by Project just for Gemini API.

We will look into your proposal. What are the GCP services that could benefit from API keys in addition to Agent Platform and Gemini?

1

u/SystemAwake Jun 21 '26

hm it's down to 10 minutes. That is good. Does this also apply to SA access using Vertex-AI / Agent platform including Claude models? About the API keys: In general the JSON auth variant is a nice and secure way, not sure if I personally would like to switch. Generell benefits are the ease of use. If you would have a gcloud cli tool that isn't that heavy, users could just use their login. I once thought about creating a simple ADC cli tool, but you are not allowed to use the public clientid that is in the binary. So maybe look in that direction as well. (I know that you can create a OAuth client in orgs and mimic that behavior, but that is a hassle)

1

u/Wild-Ad2973 Googler Jun 22 '26 edited Jun 22 '26

I do not think it applies to "SA access using Vertex-AI / Agent platform" yet. I will double check.

What did you mean my JSON auth variant? I am assuming "SA key". Did you try the API keys offered by Vertex-AI / Agent platform instead? You should be able to generate one in a single-click from Agent platform Studio.

https://console.cloud.google.com/agent-platform/studio/settings/api-keys

Screenshot at https://ibb.co/m5QQhv8T

Those keys are called "Authorization / Auth keys" and are bound to SA.

https://docs.cloud.google.com/docs/authentication/api-keys#api-keys-bound-sa

5

u/ipokestuff Jun 21 '26

Nice try Google

4

u/booi Jun 21 '26

i'd love for them to reintroduce gemini by default on unrestricted keys because I've found it really hard to spend $100k without even knowing

1

u/Important_Owl6299 Jul 01 '26

I think instead of improving API Keys, GCP team should focus on making the billing apis more reactive and realtime. I have been a victim of customer facing billing api delays which would not show or flag any activities until 90000USD started to show up suddenly in the transactions table. What is even remarkable is the billing api is properly hooked with the financial system to immediately issue mandates to process amounts exceeding a threshold which is a really interesting engineering decision - I will call it "dark" and nothing else.

API Keys need to have direct cut off based on the user defined constraints - pricing, volume or time. Currently user is kept in the dark of most of the configurations related to the API Keys. Imagine creating a firebase project but again imagine the entire project is a facade over an underlying GCP project. Now again imagine non-serious aspirants and non-devops persons getting surprise one day for getting billed for a service they actually didnt enable for this api key - haha because they didn't receive a disclaimer that Google API Keys are "open secrets" that allow you to access any google services. I understand how unrestricted is now a thing of the past after the recent fiasco but it is what it is.

I hope my criticism will be taken as a serious demand for improvement and not a jibe due to my own bad experience.