[Bug]: Getting invalid key for gemini

[grizdum]

Bug Description

sorry i am new to this: after update to latest can't connect to gemini anymore getting:

API call failed (attempt 1/3): BadRequestError [HTTP 400]
🔌 Provider: gemini Model: gemini-3.1-pro-preview
🌐 Endpoint: https://generativelanguage.googleapis.com/v1beta/openai
📝 Error: HTTP 400: Error code: 400 - [{'error': {'code': 400, 'message': 'API key not valid. Please pass a valid API key.', 'status': 'INVALID_ARGUMENT', 'details': [{'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'API_KEY_INVALID', 'domain': 'googleapis.com', 'metadata': {'service': 'generativelanguage.googleapis.com'}}, {'@type': 'type.googleapis.com/google.rpc.LocalizedMessage', 'locale': 'en-US', 'message': 'API key not valid. Please pass a valid API key.'}]}}]
📋 Details: [{'error': {'code': 400, 'message': 'API key not valid. Please pass a valid API key.', 'status': 'INVALID_ARGUMENT', 'details': [{'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'API_KEY_INVALID', 'domain': 'googleapis.com', 'metadata': {'service': 'generativelanguage.googleapis.com'}
⚠️ Non-retryable error (HTTP 400) — trying fallback...
❌ Non-retryable error (HTTP 400): HTTP 400: Error code: 400 - [{'error': {'code': 400, 'message': 'API key not valid. Please pass a valid API key.', 'status': 'INVALID_ARGUMENT', 'details': [{'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'API_KEY_INVALID', 'domain': 'googleapis.com', 'metadata': {'service': 'generativelanguage.googleapis.com'}}, {'@type': 'type.googleapis.com/google.rpc.LocalizedMessage', 'locale': 'en-US', 'message': 'API key not valid. Please pass a valid API key.'}]}}]
❌ Non-retryable client error (HTTP 400). Aborting.
🔌 Provider: gemini Model: gemini-3.1-pro-preview
🌐 Endpoint: https://generativelanguage.googleapis.com/v1beta/openai
💡 This type of error won't be fixed by retrying.
─ ⚕ Hermes ─────────────────────────────────────────────────────────────────────────────────────────────────────────

 Error: Error code: 400 - [{'error': {'code': 400, 'message': 'API key not valid. Please pass a valid API
 key.', 'status': 'INVALID_ARGUMENT', 'details': [{'@type': 'type.googleapis.com/google.rpc.ErrorInfo',
 'reason': 'API_KEY_INVALID', 'domain': 'googleapis.com', 'metadata': {'service':
 'generativelanguage.googleapis.com'}}, {'@type': 'type.googleapis.com/google.rpc.LocalizedMessage', 'locale':
 'en-US', 'message': 'API key not valid. Please pass a valid API key.'}]}}]

api key is valid i am sure of it using it with openclaw and as i said worked fine before update. openclaw said

"When Hermes is set to provider: gemini, it uses Google's native API format. But because that base_url is pointed at the .../openai compatibility endpoint, Hermes essentially sends a native Gemini request to an OpenAI-formatted endpoint.

When Google's servers receive that, they get confused. They look for the OpenAI Bearer token, but Hermes is sending the native x-goog-api-key header. The server immediately rejects it and says "API key not valid"—not because your key is actually bad, but because it was sent to the wrong door in the wrong format!"

it tried to fix it by removing the base url but to no avail. i don't know if this is a bug or i am doing something wrong sorry again.

Steps to Reproduce

run hermes chat and say you there

Expected Behavior

Connecting to gemini and answering.

Actual Behavior

Giving the error above.

Affected Component

CLI (interactive chat)

Messaging Platform (if gateway-related)

No response

Debug Report

Report     https://paste.rs/9D7K4
  agent.log  https://paste.rs/Of8Iv

Operating System

windows 11

Python Version

No response

Hermes Version

No response

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR

[hsntommy2001]

same here, Api key check is correct, even Ubuntu re-install but problem still exist

[alizane]

Hey @grizdum and @hsntommy2001 , I've tracked down the root cause and I'm opening a PR for this right now.

Root Cause: The recent update shifted the Gemini provider to use Google's /openai compatibility endpoint. However, the client initialization is still manually injecting the native x-goog-api-key header. Google's /openai server expects a standard Bearer token and rejects the request with a 400 when it sees the native header mixed in.

Writing up the fix to conditionally handle the headers based on the active base_url. I'll link the PR shortly!

[teknium1]

Fixed by PR #12251 (#12251), merged as ca32a2a on main.

Root cause: #11961 added a Google-specific header hack that worked at merge time but stopped working after Google tightened their /v1beta/openai endpoint — sending both Authorization: Bearer and x-goog-api-key now returns API key not valid (see header matrix @ciiiii posted in #12127). The fix reverts to plain Bearer auth, which works for AIza… keys.

If your key starts with AQ., that's a separate upstream Google bug (https://discuss.ai.google.dev/t/140545) — Google acknowledged it and their workaround is to regenerate the key in AI Studio, which produces a non-AQ legacy-format key that works.

Credit to @alizane for the root-cause triage (and opening #12204), @helix4u for the merged implementation, and @ciiiii for the header analysis.

Fix will ship in the next release; hermes update will pick it up once released.