Skip to content

Authentication

Jump to bottom
Gunpal Jain edited this page Nov 15, 2026 · 6 revisions

This page covers the ways the SDK can authenticate with the Gemini Developer API (GoogleAi) and Vertex AI (VertexAI). For constructors and environment variables, see Initialization.

Overview

Platform Method Package
Gemini API API key (constructor or GOOGLE_API_KEY) Google_GenerativeAI
Gemini API OAuth access token / authenticator (tuning, semantic retrieval) Google_GenerativeAI (+ Google_GenerativeAI.Auth for authenticators)
Vertex AI Application Default Credentials (GoogleCloudAdcAuthenticator) Google_GenerativeAI
Vertex AI Access token (constructor or GOOGLE_ACCESS_TOKEN) Google_GenerativeAI
Vertex AI OAuth user flow (GoogleOAuthAuthenticator) Google_GenerativeAI.Auth
Vertex AI Service account (GoogleServiceAccountAuthenticator) Google_GenerativeAI.Auth
Vertex AI Express mode with an API key Google_GenerativeAI

Authenticators implement IGoogleAuthenticator (namespace GenerativeAI.Core). The concrete classes are in the GenerativeAI.Authenticators namespace. Pass one through the authenticator parameter of VertexAI, VertexAIModel, GoogleAIPlatformAdapter or VertextPlatformAdapter. The SDK then gets, validates and refreshes access tokens for you.

dotnet add package Google_GenerativeAI.Auth   # only for OAuth / service-account authenticators

Gemini API

API key

using GenerativeAI;

// From the environment
Environment.SetEnvironmentVariable("GOOGLE_API_KEY", "YOUR_API_KEY");
var ai = new GoogleAi();

// Or explicitly
var ai2 = new GoogleAi("YOUR_API_KEY");

If neither is available, GoogleAIPlatformAdapter throws ArgumentException("API Key is required for Google Gemini AI.").

OAuth access token (tuned models, semantic retrieval)

Some Gemini API endpoints need an OAuth access token in addition to the API key:

// A token you already have
var ai = new GoogleAi("YOUR_API_KEY", accessToken: "YOUR_ACCESS_TOKEN");

// Or an authenticator that gets and refreshes tokens
using GenerativeAI.Authenticators;

var adapter = new GoogleAIPlatformAdapter("YOUR_API_KEY",
    authenticator: new GoogleServiceAccountAuthenticator("path/to/service_account.json"));
var ai3 = new GoogleAi(adapter);

GoogleAi.CreateCorpusManager(authenticator) and GoogleAi.CreatSemanticRetrieverModel(modelName, authenticator: ...) require an authenticator. See Semantic Search Retrieval with Google AQA.

Vertex AI

When you pass neither an authenticator nor an access token, Vertex AI uses Application Default Credentials. It looks for credentials in GOOGLE_WEB_CREDENTIALS, then GOOGLE_APPLICATION_CREDENTIALS, then the gcloud default file (%APPDATA%/gcloud/application_default_credentials.json, or the equivalent path on Linux and macOS).

Application Default Credentials (ADC)

GoogleCloudAdcAuthenticator is part of the core package. It gets tokens by running gcloud auth application-default print-access-token, so the gcloud CLI must be installed and you must have run gcloud auth application-default login.

using GenerativeAI;
using GenerativeAI.Authenticators;

var vertex = new VertexAI("your-project-id", "global",
    authenticator: new GoogleCloudAdcAuthenticator());

// Equivalent, using the platform adapter
var adapter = new VertextPlatformAdapter("your-project-id", "global",
    new GoogleCloudAdcAuthenticator());
var vertex2 = new VertexAI(adapter);

Access token

var vertex = new VertexAI("your-project-id", "global", accessToken: "YOUR_ACCESS_TOKEN");
// or set GOOGLE_ACCESS_TOKEN

Service account (Google_GenerativeAI.Auth)

using GenerativeAI.Authenticators;

// JSON key file (recommended)
var authenticator = new GoogleServiceAccountAuthenticator("path/to/service_account.json");

// Or a stream with the JSON key
// var authenticator = new GoogleServiceAccountAuthenticator(File.OpenRead("service_account.json"));

// Or service-account email + .p12 certificate (+ passphrase)
// var authenticator = new GoogleServiceAccountAuthenticator("sa@project.iam.gserviceaccount.com", "key.p12", "notasecret");

var vertex = new VertexAI("your-project-id", "global", authenticator: authenticator);

// Or via the adapter
var adapter = new VertextPlatformAdapter("your-project-id", "global", authenticator);
var vertex2 = new VertexAI(platformAdapter: adapter);

OAuth user flow (Google_GenerativeAI.Auth)

GoogleOAuthAuthenticator takes the path to an OAuth client secret JSON file (default client_secret.json). It runs the browser-based consent flow and stores the token in token.json.

using GenerativeAI.Authenticators;

var authenticator = new GoogleOAuthAuthenticator("path/to/client_secret.json");
var vertex = new VertexAI("your-project-id", "global", authenticator: authenticator);

Express mode (API key)

var vertex = new VertexAI(expressMode: true, apiKey: "YOUR_API_KEY");

Express mode needs no project ID or OAuth token. It throws ArgumentException if no API key is passed and GOOGLE_API_KEY is not set.

Getting a token directly

var token = await authenticator.GetAccessTokenAsync();
Console.WriteLine(token?.AccessToken);

Related Pages

API Reference

Home

Getting Started

Core Features

Gemini APIs

Vertex AI

Integrations

Guides

Legacy

Clone this wiki locally