Title: AQ. API key returns 401 "Expected OAuth 2 access token" (ACCESS_TOKEN_TYPE_UNSUPPORTED)
on a fully-configured project — Generative Language API enabled, key restricted, billing on.
Summary
-------
Every API key on my account (all AQ. prefix, since AI Studio no longer issues AIza keys) returns
401 UNAUTHENTICATED / ACCESS_TOKEN_TYPE_UNSUPPORTED when calling the Gemini API
(generativelanguage.googleapis.com), for BOTH generateContent and files.upload. This persists after
applying every documented remediation. I believe my project/account is caught in the AQ-key rollout
that is breaking the Generative Language API endpoint for some accounts.
Account / project
-----------------
- Account: m...@gmail.com (AI Studio plan "Pro")
- Project "Mirage": ID gen-lang-client-0867379..., number 30409593...
- Project "AI Avatar and Scene Generation": ID gen-lang-client-043153...
- Key: gemini-mirage-key, key ID f95ecb07-19b3-4f18-898b-.....(last-4 ...GCeQ)
- Bound service account: ais-gemini-key-
- Additional keys tested: ...WFhw (project gen-lang-client-04315.....1), ...sB6g — all 401.
Configuration verified CORRECT (so the usual fixes don't apply)
---------------------------------------------------------------
- Generative Language API ("Gemini API", generativelanguage.googleapis.com): ENABLED on the project.
- Key API restriction: already restricted to "Gemini API".
- Key is bound to the service account above.
- Billing: enabled (Tier 1 · Prepay).
Exact error (verbatim)
----------------------
HTTP 401 UNAUTHENTICATED
{
"error": {
"code": 401,
"message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login
cookie or other valid authentication credential. See
https://developers.google.com/identity/sign-in/web/devconsole-project.",
"status": "UNAUTHENTICATED",
"details": [{"@type":"type.googleapis.com/google.rpc.ErrorInfo",
"reason":"ACCESS_TOKEN_TYPE_UNSUPPORTED",
"metadata":{"service":"generativelanguage.googleapis.com",
"method":"google.ai.generativelanguage.v1beta.FileService.CreateFile"}}]
}
}
(Identical for generateContent.)
Environment
-----------
- macOS; Python 3.9 and 3.14.
- google-genai SDK v2.10.0 (latest; upgrading changed nothing).
- No Vertex/OAuth env vars set (GOOGLE_GENAI_USE_VERTEXAI, GOOGLE_APPLICATION_CREDENTIALS,
GOOGLE_CLOUD_PROJECT, GOOGLE_API_KEY all UNSET).
Everything I tried — all return the identical 401
--------------------------------------------------
1. SDK genai.Client(api_key=KEY) -> models.generate_content (text only) -> 401
2. SDK client.files.upload(...) -> 401
3. Raw REST POST .../v1beta/models/gemini-2.5-pro:generateContent
header "x-goog-api-key: KEY" (documented header) -> 401
4. Raw REST with "?key=KEY" query param -> 401
5. Raw REST with "Authorization: Bearer KEY" -> 401
6. Same on the v1 endpoint (not v1beta) -> 401
7. Three different keys across two projects -> all 401
8. Upgraded SDK to latest -> no change
So the rejection is server-side and independent of SDK, header style, endpoint version, and key/project.
What I need
-----------
Please un-flag / fix my project(s) so AQ. keys authenticate against generativelanguage.googleapis.com,
OR tell me the exact working auth method for an AQ. key bound to a service account. Happy to provide any
console value or screenshot. Thank you.
Hello Mark,
Can you share your code ? For me I was seeing similar issues because I wasn’t loading the API key correctly in the curl request. It works when I paste it directly.
Hi, thanks for the thread — I’m seeing the exact same issue and can add a data point.
**Project:** gen-lang-client-07240409.. (“Hermes2”)
**Key name:** “Voix Gemini TTS” (AQ. format, generated in AI Studio)
**Model:** gemini-2.5-flash-preview-tts
**Auth method:** header `x-goog-api-key` (confirmed correct method, matches other repro cases here)
Confirmed fully configured on my end before reporting:
- API key restriction is set to “Gemini API” only
- Bound service account (`ais-gemini-key-…@…iam.gserviceaccount.com`) shows as “Enabled” in IAM
- Billing tier: free tier, same as 5 other Gemini TTS keys I run in parallel on separate projects — those 5 authenticate fine (just hit normal 429 quota), only this one AQ. key returns:
```
401 UNAUTHENTICATED
“Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential.”
```
So it’s isolated to this one project/key, not a blanket account-level AQ. issue — the other 5 keys on the same Google account work normally. Any update on root cause, or is there a specific action (delete+recreate the key, re-link the service account) that’s known to resolve this for an isolated case like mine? Happy to provide more repro details if useful.
We have the same issue. I have an API key in my aistudio account created some time ago, and it works, but it is a free tier account and key, therefore it is not suitable for any serious development work (it gets throttled often).
My client just added about $60 to his aistudio account, and created his own paid API key that I could use to develop Google Apps script projects using Gemini. When tested with a very simple Apps script, and also using curl commands, it returns basically the same error response presented by the OP.
We need a fix for this issue ASAP, because all our Apps script projects that use Gemini are on hold, until we can use a paid API key. Thanks.
Hello, I am experiencing the same issue with an AQ.-prefixed API key.
My setup is:
- Frontend: Bolt.new
- Backend: Supabase Edge Function
- API: Gemini API
- Model: gemini-2.0-flash
When the Edge Function calls the Gemini API, I receive:
401 UNAUTHENTICATED — ACCESS_TOKEN_TYPE_UNSUPPORTED
I have already tried the following:
- Using the
x-goog-api-keyheader - Using the
?key=query parameter - Creating a new API key in Google AI Studio
- Checking the API key configuration and environment variables
- Calling the Gemini API from the server side rather than directly from the browser
The same 401 authentication error persists.
The API key generated by Google AI Studio starts with AQ.. I understand that AI Studio now generates AQ.-prefixed keys instead of the older AIzaSy keys.
Could you please confirm whether AQ.-prefixed keys are currently supported for server-side REST API calls from a Supabase Edge Function?
If they are supported, could you advise what configuration is required to resolve ACCESS_TOKEN_TYPE_UNSUPPORTED?
This is preventing my Bolt/Supabase application from using Gemini API, so I would greatly appreciate any guidance.
Thank you.
Hello @nabe_wata ,
The gemini-2.0-flash model is deprecated. Try using latest Gemini models.
If you still face the 401 error after updating the model, please let us know along with a CURL to reproduce the exact request syntax that you are using.
I am receiving:
401 UNAUTHENTICATED
ACCESS_TOKEN_TYPE_UNSUPPORTED
The project has Generative Language API enabled.
A fresh AQ. API key produces the same error.
The failure occurs both with:
- google-genai SDK
- Direct REST API using x-goog-api-key
The error is:
“Expected OAuth 2 access token, login cookie or other valid authentication credential.”
Please review the project’s AQ authentication/key status.