01 · The steps
Pick the route that matches your situation
Create the key
- 1Go to aistudio.google.com and sign in with your Google account.
- 2Find the Get API key option.
- 3Choose to create the key in a new project, or select an existing Google Cloud project.
- 4Copy the key when it is shown.
- 5Store it somewhere safe immediately. Treat it like a password, because functionally it is one.
Use it safely in a project
The most common and most expensive mistake is committing the key.
- 1Put the key in a .env file, for example as GEMINI_API_KEY.
- 2Add .env to your .gitignore before your first commit.
- 3Read it in your code from the environment, never as a literal string.
- 4Call the API from your server, not from browser JavaScript, so the key is never sent to the user.
- 5If a key is ever exposed, delete it in AI Studio and issue a new one rather than hoping nobody noticed.
02 · Read this first
What most guides leave out
A key in client-side code is a public key
Anything running in the browser can be read by anyone using the site. Calling the Gemini API directly from front-end JavaScript hands your key to every visitor, and the bill for their usage to you. Proxy the call through your own backend.
Committed keys are found automatically
Public repositories are scanned continuously for credentials. A key pushed to GitHub, even in a commit you immediately reverse, should be treated as compromised, because the history keeps it. Revoke and reissue.
Free tier data handling is not the same as paid
Google's terms for free-tier API usage differ from paid usage in how data may be used. If you are sending anything you would not want reviewed, read the current terms rather than assuming API access means private by default.
Rate limits will find you in production
The free tier is comfortable for building and unpleasant for launching. Handle rate-limit responses with backoff and retry before you have real users, not after.
03 · Questions
Frequently asked questions
Is the Gemini API free?
There is a free tier with rate limits, normally enough for prototyping and small projects. Higher usage requires enabling billing on the associated Google Cloud project. Check Google's current pricing page for rates rather than trusting a figure in an article.
What do I do if I accidentally committed my API key?
Revoke it immediately in Google AI Studio and create a new one. Do not rely on deleting the commit: the key remains recoverable in git history, and automated scanners typically find exposed keys within minutes of a push.
Can I use one key for several projects?
Technically yes, but separate keys per project are better practice. If one leaks you revoke only that one, and usage attribution stays clear when you are working out which application is consuming your quota.
What is the difference between the Gemini app and the API?
The app at gemini.google.com is the consumer chat product. The API is programmatic access for building the model into your own software, billed by usage and governed by developer terms. The key is only for the API.
Sources
Menu names change. If a step no longer matches what you see, the vendor documentation above is the authority.