Gemini CLI Kept Saying 'API key not valid' After I Gave It a New Key — It Was Reading an Old One From a Third Place
I switched Gemini CLI from Google login to a paid API key, and the 400 'API key not valid' error would not go away. The key can come from four places — the shell, a project .env, a home .env, and settings.json — and a short script that lights them up in order narrows the cause to one.
Why HTTP Referrer Restrictions on Your Gemini API Key Cause 403 Errors in Production
Walks through why a Gemini API key with HTTP referrer restrictions can suddenly return 403 PERMISSION_DENIED in production. Covers the exact referrer string format, SDK behavior differences, how to safely route around the limitation with a tiny edge proxy, and how it differs from the CORS error you hit when calling straight from the browser.
Gemini API: GEMINI_API_KEY vs GOOGLE_API_KEY — Which One Should You Actually Use?
A practical, SDK-by-SDK guide to the GEMINI_API_KEY vs GOOGLE_API_KEY confusion. Covers precedence rules, the Vertex AI auto-switch, and four real-world traps with diagnostic snippets you can paste into a running app.
Gemini API Production Security Guide — API Key Management, Prompt Injection Defense, and Audit Logging
Securing the Gemini API in production: API key rotation, input/output sanitization, prompt injection defense, audit logging, and rate limiting, with production-ready code.