Email about "Secure your Gemini API access by Jun 19, 2026" seems wrong

Gemini API
1

I received an email with that title claiming that we have somewhere an unrestricted key that enables the generative AI API and it’ll stop working after June 19th.

We are reaching out to remind you because your project currently has the Gemini API (generativelanguage.googleapis.com) enabled and contains at least one unrestricted API key. To prevent unauthorized usage, we ask you to restrict all your unrestricted API keys by June 19, 2026. After this deadline, unrestricted keys will no longer be accepted by the Gemini API.

For the life of me, I can’t figure out which key this are referring to. I went through all of the GCP projects in the organization under the credentials page and looked at all the API keys that exist. All of them are restricted to a specific subset of APIs. They are not restricted to an application, but I don’t think that’s what this is referring to.

The help page points at AI Studio showing which keys are unrestricted, but none of them have a label on them and the UI doesn’t have the functionality referred to by that page.

The last thing I want is to have our app experience downtime in a week due to not being able to find what this is referring to.

Note: The one hint that may be related is that I found that the organization policy does not enable service account API restrictions (iam.managed.disableServiceAccountApiKeyCreation is enabled) which I suspect may be affecting the UI I’m seeing in AI Studio. But the same help page that points to this org policy says

Note: You don’t need to change the organization policy constraint for authorization keys that are solely restricted to the Gemini API (generativelanguage.googleapis.com).

Thanks.

2

I had Claude check with gcloud and iterate over all of the org’s projects – it couldn’t find any unrestricted keys

3

Any API that have other api access except gemini api is unrestricted key. It kinda misleading. Restricted key only have 1 permission. This is good thing, in case 3rd party library get hijacked or llm go haywire, the damage is limited to gemini api cost only. We have users accidentally leak their legacy api key and attacker use it to spawn gpu instances.

4

You need to read my topic to know what happened: Unrestricted API key + AI Studio silently enabled Gemini — $14k bill on a small family brazilian tire shop - #10 by Lucio_Machado

Or even watch this video of the exploit: https://youtu.be/z5wfFb33RtM?is=H6K1omu1DJX-w1a3

5

You can use Cloud Asset Inventory API as detailed at https://docs.cloud.google.com/docs/authentication/api-keys#list-no-restriction-keys to list the API keys in an organization, folder, or project that don’t have restrictions.

6

We’re having an issue where we had unrestricted api keys and started getting this error:
You are experiencing temporary service disruptions since you are accessing Gemini API with one or more unrestricted keys - this is being done as a preview of the enforcement which will take effect on June 19. You MUST restrict your key now to avoid permanent disruption by going to ``https://console.cloud.google.com/apis/credentials``.
We fixed that but are still getting those errors even though all of our keys are restricted (confirmed via the UI and api)