Least-privilege Google sign-in for Gemini image transcription using each customer's free API allowance

We are building Fotorecipe for Windows and Android. The task is to send a user-selected recipe photo as inline image input to Gemini Developer API generateContent and return the visible text for editing and saving.

We want each customer to use only their own eligible, unbilled free API allowance, with familiar Google sign-in and no manual Cloud project or API-key setup. We do not want a publisher/shared allowance or automatic paid usage.

An isolated Desktop OAuth test using cloud-platform displayed permission to see, edit, configure and delete Google Cloud data. We cancelled before granting access. We have not established that this broad permission is necessary for the image request itself.

Could Google clarify:

  1. What is the documented minimum OAuth permission for generateContent with inline image input? Is a Gemini-specific or cloud-platform.read-only permission supported for this operation?
  2. Is a supported consumer connection flow available that binds requests to each individual’s free API allowance without broad Google Cloud management access or customer-managed keys?
  3. If individual Cloud projects are required, which supported provisioning and first-use terms steps may the app handle, and which must the person complete on Google’s pages?
  4. What publisher verification is required for that supported Windows and Android flow?

We reviewed https://ai.google.dev/gemini-api/docs/oauth and https://ai.google.dev/api/generate-content but could not establish the narrower permission and complete fresh-account flow. We are asking about the Gemini Developer API free tier, not claiming that the Gemini website allowance or subscription is automatically available to third-party apps.

Please point us to the official supported approach or confirm which requirements cannot currently be combined.

Hello @Vincent_De_klerk ,

We can’t provide specific legal guidance on this forum. Please refer to the documents below:

Thank you @Pooja_Kapse for the links. I have reviewed them. Let me reframe the question around the outcome, rather than assume API-key setup or Gemini is the only answer.

The intended experience is: choose or take a clear image → receive faithful, editable text → Edit or Save. Fotorecipe must do this on Windows and Android. The platforms can use different engines if they produce the same useful result. Printed recipe and receipt text includes fractions, amounts, units, columns and instructions. Small user corrections are acceptable; preserving the original photograph is essential.

We prefer on-device processing with a small footprint and no multi-gigabyte model download. Where cloud processing is needed, we want familiar consent and, where supported, resources associated with that customer. We want to avoid a shared publisher Gemini allowance or unexpected charges, and users should not have to create projects or copy API keys.

Which supported architecture would you recommend?

  1. Would ML Kit Text Recognition v2 on Android, paired with a separate Windows reader, be the sensible lightweight route? Is there another supported Google option for faithful document text without customer API-key setup? We are evaluating real photos rather than assuming an accuracy percentage.

  2. The Drive API documents image-to-Google-Docs import and text export. Is narrow drive.file consent a supported consumer image-to-text route? What ownership, data-handling, quota/billing and app-verification limits should we account for? Limits and temporary-file cleanup would need verification before use.

  3. Where Gemini materially improves extraction, is there a supported consumer sign-in or key-selection route without user-created Cloud projects or copied keys? Which permissions and Windows/Android credential architecture are supported? If this belongs elsewhere, could you point us to the right product team or forum?

The original OAuth questions remain in the first post. We are asking for product and technical guidance, not individual legal advice, and are open to a different approach that achieves this simple photo-to-text experience.

One concrete lead from Cloud Console while checking the publisher setup: its scope selector currently lists https://www.googleapis.com/auth/generative-language.peruserquota under Gemini API, described as “Use your Google Account to access generative AI capabilities in this app.”

Is this supported for third-party consumer applications on Windows and Android? Which documented endpoints and models accept it, what user or project resources are required, and whose quota and billing apply? Could ordinary users consent without creating a Cloud project or copying an API key?

If it is limited to particular Google products or approved partners, please clarify that boundary and any supported eligibility process. We have only observed the scope in the selector; we have not granted it or made a request using it. An official implementation or product-team reference would help us avoid inferring a supported customer flow from the label alone.