Connect a Google Cloud API key for Vertex AI

Before you start

Google’s terms for its generative AI services forbid a service likely to be used by anyone under 18. Give allowances on Google only to people of 18 or older: you confirm it when you connect the key, and each person confirms their age when they accept an allowance or claim one.

A Gemini API key from Google AI Studio is not the same thing, though it looks the same: its terms forbid letting others use it, and this service never calls the Gemini API. Make the key in the Google Cloud console.

For its newest models, Google may keep prompts and answers in your Google Cloud account for up to 30 days, for automated safety review. We don’t store prompts or answers.

Create the key

With a @gmail.com account, the quickest way is Vertex AI’s express mode: follow Google’s Get a Google Cloud API key and link a billing account, so the key outlives the trial.

In a project of your own, with a billing account, make a key bound to a service account, which Google calls an authorization key:

1. In the IAM console, create a service account for this key and grant it the role roles/aiplatform.user (Vertex AI User), and no other.
2. Open Credentials, choose Create credentials, then API key.
3. Restrict the key to the one API aiplatform.googleapis.com, the Vertex AI API.
4. Tick Authenticate API calls through a service account, and choose the service account you made.
5. Create the key and copy it: it starts with AIza.

Newer organizations block service-account API keys by default. An administrator must allow them for aiplatform.googleapis.com using the organization policy constraints/iam.managed.disableServiceAccountApiKeyCreation. Google’s guide: API keys.

Or use a service account’s key file

Where your organization forbids binding an API key to a service account, give Tokens On Me the service account’s JSON key file instead. Google calls such files a security risk if not managed carefully: anyone with the file can act as the service account until the key is revoked. Tokens On Me uses it only to ask Google for an access token that lasts an hour, and keeps that token only in memory.

1. In the IAM console, create a service account for this file and grant it the role roles/aiplatform.user (Vertex AI User), and no other.
2. Open the service account, then its Keys tab. Choose Add key, then Create new key, with JSON as the key type: the file downloads, and Google does not give it again.
3. Paste the whole file, as it is, in the key’s field on the Keys screen, then delete the downloaded copy.

Where the organization policy iam.disableServiceAccountKeyCreation is enforced, as it is by default in organizations created since 2024, no key file can be made in the project until an administrator lifts it. Google’s guide: create and delete service account keys.

Set a budget

Google Cloud’s budgets warn you, and its spend caps can pause Vertex AI, but neither acts as requests happen: Google writes that a cap is not enforced at once, and that anything over it is billed. Tokens On Me sets money aside on each allowance before every request, and checks that the balance can cover the reservation.

1. In Budgets & alerts, create a monthly budget on the key’s project with an email alert.

Connect it

1. Sign in, open Keys, paste the key under Google Vertex AI, confirm that your allowances on it go only to people of 18 or older, and save.
2. Create an allowance in Allowances and choose this provider key.

Stop access

In Credentials, delete the key; for a key file, delete its key on the service account’s Keys tab. Vertex AI refuses every request made with it from then on, though an access token already given may work until its hour is up. Disconnecting it on the Keys screen stops new requests through this service immediately.