Bug Report: Confusing and Fragmented Authentication Flow for New CLI Users on Google Workspace

[GibbyAung]

What happened?

Description:

When setting up the Gemini CLI for the first time with a Google Workspace account, the authentication and authorization process is difficult and leads to multiple, non-obvious errors. This creates significant friction and requires deep knowledge of the Google Cloud Console to resolve.

Steps to Reproduce:

As a Google Workspace user, install the Gemini CLI.

Attempt to log in using the standard command.

Error 1: You immediately receive the Failed to login. Workspace accounts... must configure GOOGLE_CLOUD_PROJECT... Message: Request contains an invalid argument error. The error is unclear about why the argument is invalid.

After setting the GOOGLE_CLOUD_PROJECT environment variable and authenticating via gcloud auth application-default login, you try again.

Error 2: You then receive a 403 PERMISSION_DENIED error for the project, with the reason "CONSUMER_INVALID" and referencing the cloudaicompanion.googleapis.com service. This error message does not explicitly state which API needs to be enabled or which IAM role is missing.

The user must then manually navigate the GCP Console to enable the "Cloud AI Companion API" and grant their user the "Cloud AI Companion User" role. This information is not provided anywhere in the CLI's error feedback.

What did you expect to happen?

Expect to login smoothly and when started to give command it expects it work instead of showing this error
✕ [API Error: [{
"error": {
"code": 403,
"message": "Permission denied on resource project "scenic-precinct-464106-m8".",
"errors": [
{
"message": "Permission denied on resource project "scenic-precinct-464106-m8".",
"domain": "global",
"reason": "forbidden"
}
],
"status": "PERMISSION_DENIED",
"details": [
{
"@type": "type.googleapis.com/google.rpc.ErrorInfo",
"reason": "CONSUMER_INVALID",
"domain": "googleapis.com",
"metadata": {
"consumer": "projects/"scenic-precinct-464106-m8"",
"containerInfo": ""scenic-precinct-464106-m8"",
"service": "cloudaicompanion.googleapis.com"
}
},
{
"@type": "type.googleapis.com/google.rpc.LocalizedMessage",
"locale": "en-US",
"message": "Permission denied on resource project "scenic-precinct-464106-m8"."
},
{
"@type": "type.googleapis.com/google.rpc.Help",
"links": [
{
"description": "Google developers console",
"url": "https://console.developers.google.com"
}
]
}
]
}
}
]]

Client information

• CLI Version: 0.1.4
• Git Commit: 1078a54
• Operating System: win32 v22.15.0
• Sandbox Environment: no sandbox
• Model Version: gemini-2.5-pro
• Memory Usage: 114.0 MB

Login information

No response

Anything else we need to know?

No response

[vessenes]

FWIW, this sounded promising to me, however I do not have the "Cloud AI Companion API" or the listed User role in my gcp console. I did enable Gemini at https://console.cloud.google.com/apis/library/cloudaicompanion.googleapis.com.

This feels super opaque!

[Chandher05]

This is so confusing, do I have to use Vertix, google api key or workspace. Such a terrible UX challenge. I am clicking on random things to figure this out. Can google please give us any information that is more structured on how we can do this better

[repentsinner]

Agreed, I suspect you are losing a significant number of users to Claude Code on this point alone. The friction here is ridiculous.

[srithreepo]

Hi All,

Thank you so much for your feedback, We've made significant improvements to this space, including changing some of the flows as well as updating our Authentication documentation at authentication.md . Additionally we do plan to continue further improvements and enhancements to make authentication easirer and more effective.

Please feel free to reply here if you still have issues on the authentication front. Additionally if you have specific improvements you would like, please feel free to file feature requests as well.