In a nutshell: Google eliminates the security risk of unrestricted API keys in Gemini through a phased migration to authentication keys with granular access control by September 2026.
Google is introducing a blocking mechanism for unrestricted standard API keys in the Gemini API from June 19, 2026. This is intended to prevent cybercriminals from abusing publicly discoverable keys to conduct computationally intensive AI requests at the expense of developers.
For years, standard API keys for services like Google Maps or Firebase were not treated as confidential by developers and were integrated directly into publicly discoverable source code. When Google activated the Generative Language API, these keys automatically gained access to Gemini interfaces. Cybercriminals exploited this security loophole deliberately: they identified public keys and conducted computationally intensive AI queries, with the costs borne by the original key holders. This led in several cases to massive billing increases and substantial financial damage.
Google is now implementing a two-stage security model. In the first step, the Gemini API will block all requests from unrestricted standard keys starting June 19, 2026. Only keys to which explicit restrictions have been applied will remain functional. Affected developers must restrict their existing keys in Google AI Studio or the Cloud Console before this deadline to avoid service interruptions. In the second step, Google will migrate fully to a new key type called Auth-Keys starting in September 2026.
Auth-Keys are directly bound to service accounts within Google Cloud, enabling granular access control. Requests are processed under the specific identity of the respective service account, which allows the system to block compromised keys immediately and in a targeted manner. New keys generated in Google AI Studio already receive this security feature automatically.
Source: www.it-daily.net · Published June 22, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.1.