I have recently been testing the Gemini Interactions API in a web application that analyzes legal text, extracts legal citations, and then performs web searches to verify each citation.
The application was deployed and worked correctly for approximately the first 12 hours. After that, requests using Gemini Interactions started consistently failing with the following error when retrieving the status of a background interaction:
403 - PERMISSION_DENIED The provided user ID does not match the user ID associated with the given session. Provided user ID type: api_key and associated user ID type: api_key
The workflow is essentially:
- Create an interaction with
background: trueandstore: true. - Store the returned interaction ID.
- Periodically call
interactions.get(interactionId)to check its status. - Once the interaction is completed, return the result to the client.
The interaction is created successfully and an interaction ID is returned. The 403 PERMISSION_DENIED error occurs when attempting to retrieve the interaction using interactions.get().
All requests are authenticated using the same Gemini API key.
The application also uses the google_search tool because each interaction may need to search the web to verify legal citations:
{ background: true, store: true, tools: [{ type: "google_search" }] }
An important observation is that if I disable background and wait synchronously for Gemini to complete the request, the application works normally. The issue therefore appears to be specifically related to background interactions and/or retrieving their state.
The application received a significant amount of traffic after being published, with multiple users potentially creating several interactions in a short period of time. I am not sure whether this level of concurrency, combined with google_search and background execution, could have triggered some kind of limitation or session-related issue.
Has anyone encountered this specific 403 PERMISSION_DENIED error with background Interactions? Could this be related to concurrent background interactions, API key/session association, or the use of google_search?