Free Gemini API Key Tester: Validate Your Gemini API Key Online

Ready

A Gemini API key can fail before your application code runs because the key is invalid, restricted, revoked, or attached to a project without available quota. The tester above sends one stateless request to Google and shows the unedited HTTP status and response body, which gives you a cleaner authentication check than a full application stack.

Test a Gemini API key

Use a temporary or restricted key for a browser test because Google warns against exposing production keys in client-side apps, and choose a local terminal request for any key tied to billing or production traffic.

1. Paste the key into the password field.
2. Choose a model and keep the small default prompt.
3. Select Test key and read the HTTP status plus Google response.
4. Clear the field when you finish. Rotate the key if you pasted a sensitive key into any site you do not control.

The widget sends the key directly from your browser to generativelanguage.googleapis.com. Its request sets store to false, so the Interactions API does not retain the interaction object for later conversation state.

Use the terminal for production keys

The copied command reads your key from the GEMINI_API_KEY environment variable instead of placing it in the URL. That keeps the credential out of the command text and uses Google’s documented x-goog-api-key header.

export GEMINI_API_KEY='replace-with-your-key'

curl -sS -X POST 'https://generativelanguage.googleapis.com/v1beta/interactions' \
  -H "x-goog-api-key: $GEMINI_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{"model":"gemini-3.5-flash","input":"Reply with OK","store":false}'

I rechecked the invalid-key path against that endpoint on July 18, 2026, and Google returned HTTP 400 with status INVALID_ARGUMENT and reason API_KEY_INVALID, which shows why an invalid key does not necessarily produce a 401 response.

Read the tester response

A successful test proves that one model request worked at that moment but does not validate your application’s environment variable loading, proxy, deployment secret, request body, or quota under sustained traffic.

Choose a model that is available

Google’s model catalog lists Gemini 3.5 Flash and Gemini 3.1 Flash-Lite as stable models on July 18, 2026, and it also lists Gemini 2.5 Flash, so the tester keeps that model as a compatibility option rather than presenting retired Gemini 1.5 models.

• Gemini 3.5 Flash is the default for a basic authentication test.
• Gemini 3.1 Flash-Lite is a lower-cost stable option for lightweight calls.
• Gemini 2.5 Flash helps you check an existing integration that has not moved to the Gemini 3 family.

Model access can vary by project, region, preview enrollment, and product policy, which means an HTTP error for one model does not prove that the key fails for every model.

Understand Google’s API key transition

Google AI Studio creates authorization keys by default, binding them to a Google Cloud service account and restricting them to the Generative Language API for more specific access control and leaked-key enforcement.

Google’s API-key documentation says unrestricted standard keys are rejected, restricted standard keys continue to work for the moment, and all standard keys will be rejected in September 2026, so replace a standard key before that cutoff.

Follow the Gemini API setup guide before testing a new project, then use the Gemini and ChatGPT comparison when your larger decision is model access and plan fit rather than key validation.

Keep Gemini API keys out of application code

• Load the key from a secret manager or environment variable on your server.
• Never commit the key to Git or place it in a public frontend bundle.
• Use a backend proxy when a browser or mobile application needs Gemini output.
• Restrict the key to the Gemini API and only the environments that need it.
• Revoke and replace any key that appears in logs, screenshots, tickets, or public source code.

The browser tester is useful for a disposable diagnostic key, but a production key belongs in your own terminal or backend, where third-party page scripts cannot read the credential.

Gemini API key tester FAQ

Clear the key after the test, then reproduce the same request from the environment where your application runs to learn whether the remaining failure belongs to authentication or to your application setup.