# How do I restrict the Gemini API to prevent extra spending **URL:** \ **Category:** Gemini API\ **Tags:** api-key\ **Created:** [October 24, 2026, 1:04pm UTC](https://discuss.ai.google.dev/t/how-do-i-restrict-the-gemini-api-to-prevent-extra-spending/191970 "2026-10-24T13:04:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Daniel\_Klenda](https://d1dlmcr85iqnpo.cloudfront.net/user_avatar/discuss.ai.google.dev/daniel_klenda/32/163399_2.png) [@Daniel\_Klenda](https://discuss.ai.google.dev/u/Daniel_Klenda)\ **Post date:** [October 24, 2026, 1:04pm UTC](https://discuss.ai.google.dev/t/how-do-i-restrict-the-gemini-api-to-prevent-extra-spending/191970/1 "2026-10-24T13:04:16Z")
I was asked to restrict the API key as provided with five options none, website, IP address, android app, or iOS apps unfortunately they didn’t tell me what restriction I was supposed to put it on to prevent extra spending ---
**Author:** ![Pooja\_Kapse](https://d1dlmcr85iqnpo.cloudfront.net/user_avatar/discuss.ai.google.dev/pooja_kapse/32/24754_2.png) [@Pooja\_Kapse](https://discuss.ai.google.dev/u/Pooja_Kapse)\ **Post date:** [October 28, 2026, 7:45am UTC](https://discuss.ai.google.dev/t/how-do-i-restrict-the-gemini-api-to-prevent-extra-spending/191970/2 "2026-10-28T07:45:10Z")
Hello @Daniel_Klenda , Could you please share where you saw the prompt to restrict your API key (for example, the AI Studio API Keys page or the Google Cloud console)? In the meantime, Application restrictions only limit where requests can come from (such as a backend server’s IP addresses) and do not cap spending. If the prompt came from the [AI Studio API Keys page](https://aistudio.google.com/api-keys), you can restrict the key to the Gemini API there ([Using Gemini API keys](https://ai.google.dev/gemini-api/docs/api-key#secure-unrestricted-keys)). To limit spending: - Set a monthly project spend cap on the [AI Studio Spend page](https://aistudio.google.com/spend) ([Gemini API spend caps](https://ai.google.dev/gemini-api/docs/billing#spend-caps)) or configure a project-level [Cloud Billing spend cap budget](https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps) for the Gemini API (note that enforcement has a short processing delay, so brief overages can still occur). - Use Prepay billing or set a monthly auto-reload limit on [AI Studio Billing](https://aistudio.google.com/billing) so usage stops when prepaid credits run out. - Lower per-minute or daily request limits in Google Cloud Quotas ([Capping API usage](https://docs.cloud.google.com/apis/docs/capping-api-usage)). ---
**Author:** ![Daniel\_Klenda](https://d1dlmcr85iqnpo.cloudfront.net/user_avatar/discuss.ai.google.dev/daniel_klenda/32/163399_2.png) [@Daniel\_Klenda](https://discuss.ai.google.dev/u/Daniel_Klenda)\ **Post date:** [October 29, 2026, 1:41am UTC](https://discuss.ai.google.dev/t/how-do-i-restrict-the-gemini-api-to-prevent-extra-spending/191970/3 "2026-10-29T01:41:01Z")
In Google Cloud Console in API & Services under the sub category Credentials is the option to Edit API key Name Use a unique name to identify your API key ## APIs that can be accessed using this key **Service account required:** To use [Agent Platform API](https://console.cloud.google.com/marketplace/product/google/aiplatform.googleapis.com?project=keyinsights) or [Gemini API](https://console.cloud.google.com/marketplace/product/google/generativelanguage.googleapis.com?project=keyinsights), you must create an [authorization key](https://docs.cloud.google.com/docs/authentication/api-keys#api-keys-bound-sa)(auth key) by binding this API key to a service account. The option to bind will appear once you select either API. Note: An [organization policy](https://console.cloud.google.com/iam-admin/orgpolicies/iam-managed.disableServiceAccountApiKeyCreation?project=keyinsights) governs creating API keys bound to a service account for projects with a Google Cloud organization. [Learn more](https://docs.cloud.google.com/docs/authentication/api-keys#api-keys-bound-sa) Select API restrictions 1 API Only Agent Platform (Vertex) API and Gemini API are supported by account bound keys at this time. Enable the service in [API Library](https://console.cloud.google.com/apis/library?project=keyinsights) to use it. ### Selected APIs: - Gemini API ## Key restrictions Add restrictions to reduce security risk and prevent unauthorized use. [Learn more](https://cloud.google.com/docs/authentication/api-keys?hl=en_US#securing) Action recommended: this key can currently be used with any application. Restrict where it can be used to improve security. [Learn more](https://cloud.google.com/docs/authentication/api-keys?hl=en_US#securing) ### Application restrictions None Websites IP addresses Android apps iOS apps Note: It may take up to 5 minutes for settings to take effect ---
**Author:** ![Pooja\_Kapse](https://d1dlmcr85iqnpo.cloudfront.net/user_avatar/discuss.ai.google.dev/pooja_kapse/32/24754_2.png) [@Pooja\_Kapse](https://discuss.ai.google.dev/u/Pooja_Kapse)\ **Post date:** [November 2, 2026, 5:55am UTC](https://discuss.ai.google.dev/t/how-do-i-restrict-the-gemini-api-to-prevent-extra-spending/191970/4 "2026-11-02T05:55:42Z")
Hello @Daniel_Klenda , None of the five **Application restrictions** options cap spending—to limit costs, use the spend cap, Prepay, or quota steps shared above in this thread. Under **Application restrictions** : - Select **IP addresses** if your Gemini API calls run from a backend server with a fixed public IP ([Add application restrictions](https://docs.cloud.google.com/docs/authentication/api-keys#adding-application-restrictions)). - Leave **None** selected if you are calling from a local machine or a host without a static public IP, since your key is already restricted to the **Gemini API**. - Avoid **Websites** , **Android apps** , and **iOS apps** , as Gemini API keys should not be embedded in client-side apps ([Critical security rules](https://ai.google.dev/gemini-api/docs/api-key#critical-security-rules)).