Two Auth Paths

One model family, two front doors

Beyond the AI Studio vs Vertex split (the developer-vs-enterprise choice), there's a third path Google ships: Cloud Code Assist. It's the OAuth-based endpoint used by Gemini CLI, IDE extensions, and (relevantly here) cwkPippa's free OAuth fallback.

The two paths side-by-side

Aspect	API Key (developer)	OAuth (Cloud Code Assist)
Endpoint	`generativelanguage.googleapis.com`	`cloudcode-pa.googleapis.com`
Auth header	`x-goog-api-key: KEY`	`Authorization: Bearer TOKEN`
Cost	Paid (or AI Studio free tier)	Free for personal Gmail
Rate limit	5–15 RPM (free tier)	~60 RPM
Pre-flight	None	Must call `loadCodeAssist` first
Token refresh	N/A — keys don't expire	Standard OAuth refresh dance

Why care about the OAuth path

The OAuth path is what powers "free tier with real rate limits." If you have a personal Google account, you can hit it without a billing setup. The trade-off: it's the internal API, the shape can change with less notice, and you're on a daily quota. Use it as a fallback, not as primary production.

The credential file

OAuth credentials live in ~/.gemini/oauth_creds.json (the Gemini CLI puts them there). Format is the standard Google OAuth refresh-token JSON.

Code

Path A — API Key·text

POST https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent
Header: x-goog-api-key: $GEMINI_API_KEY
Header: Content-Type: application/json

Body:
{
  "contents": [{"parts": [{"text": "Hello"}]}]
}

Path B — OAuth (Cloud Code Assist)·text

POST https://cloudcode-pa.googleapis.com/v1internal:generateContent
Header: Authorization: Bearer $ACCESS_TOKEN
Header: Content-Type: application/json

Body (note the wrapper):
{
  "model": "gemini-2.5-flash",
  "project": "projects/.../locations/global/...",   ← from loadCodeAssist
  "request": {
    "contents": [{"role": "user", "parts": [{"text": "Hello"}]}],
    "generationConfig": {}
  }
}

Credential file shape·json

// ~/.gemini/oauth_creds.json
{
  "access_token": "ya29.a0...",
  "refresh_token": "1//06...",
  "token_type": "Bearer",
  "expiry_date": 1756789012345
}

Exercise

Install the Gemini CLI (npm i -g @google/gemini-cli), run gemini login, and confirm ~/.gemini/oauth_creds.json exists. Then read the file and identify which fields are needed to refresh the token (next lesson). Compare the request shape that the CLI uses (you can intercept with mitmproxy if curious) to the API key path.