Gemini API 403 Forbidden Error: How to Fix

The Google Gemini API returns a 403 Forbidden (often labeled as PERMISSION_DENIED) error when your API request is authenticated, but the server refuses to authorize the operation. Unlike a 401 error, which indicates an invalid or missing API key, a 403 error means your key is recognized but lacks the permission to perform the requested action.

This guide explains the most common causes of the Gemini 403 error and provides step-by-step instructions to fix it.

---

Common Causes of Gemini API 403 Errors

Before troubleshooting, it helps to understand why Google's servers are blocking your request. The most common reasons include: * Geographical Restrictions: You are making requests from an unsupported country or region, or your hosting provider's IP block is restricted. * Disabled API Services: The Generative Language API is not enabled within your Google Cloud project. * API Key Restrictions: Your API key has security restrictions configured in the Google Cloud Console that block Gemini requests. * Billing Issues: Your project requires an active billing account to access specific models or quotas. * IAM Role Issues (Vertex AI): If you are using Vertex AI instead of Google AI Studio, your service account may lack the necessary IAM permissions.

---

How to Resolve the Gemini API 403 Error

Follow these troubleshooting steps in order to identify and resolve the issue.

1. Check Regional Availability Google Gemini API services are not available in all countries. If you are developing locally or hosting your application on a cloud server, the request origin must be in a supported region.

1. Review the official Google AI Studio region availability list to ensure your country is supported.
2. If you are hosting on an external VPS or cloud provider (such as AWS, DigitalOcean, or Vercel), check the physical region of your server deployment. If your server is deployed in an unsupported region, re-deploy it to a supported location (such as us-central1).
3. Disable any VPNs or proxies on your development machine that route traffic through unsupported regions.

2. Verify the Generative Language API is Enabled Your API key must be linked to a Google Cloud project that has permission to use Gemini.

1. Go to the Google Cloud Console (console.cloud.google.com).
2. Select the project associated with your API key from the project dropdown menu.
3. Navigate to APIs & Services > Library.
4. Search for Generative Language API.
5. Click on it and verify that the status is Enabled. If it is disabled, click Enable.

3. Clear API Key Restrictions API keys can be restricted to only run specific Google APIs. If your key was generated for maps, YouTube, or general firebase tasks, it will return a 403 when hitting Gemini endpoints.

1. In the Google Cloud Console, navigate to APIs & Services > Credentials.
2. Click on the API key you are using for Gemini.
3. Scroll down to the API restrictions section.
4. Ensure that either Don't restrict key is selected, or that Generative Language API is explicitly checked under the restricted API list.
5. Save changes and wait 3 to 5 minutes for the changes to propagate globally.

4. Link an Active Billing Account While Google AI Studio offers a free tier, certain models, usage limits, or enterprise features require a project with billing enabled. If your project has exceeded the free limits or requires paid access, you will receive a 403 error.

1. Open the Google Cloud Console and go to the Billing section.
2. Confirm that a valid credit card or payment method is attached to your billing account.
3. Ensure your specific project is linked to this billing account. If it says "This project has no billing account," link your active account to lift payment-related blocks.

5. Check IAM Permissions (For Vertex AI Users) If you are accessing Gemini models via the Google Cloud SDK or Vertex AI rather than AI Studio, you must use proper Identity and Access Management (IAM) configurations.

1. Go to IAM & Admin in your Google Cloud Console. 2. Locate the Service Account or User Principal running your code. 3. Ensure the account has the Vertex AI User (roles/aiplatform.user) role assigned. 4. If using a service account key file locally, double-check that your terminal's environment variable is pointed to the correct JSON key file: export GOOGLE_APPLICATION_CREDENTIALS="/path/to/your/keyfile.json"

---

When to Escalate

If you have verified that your region is supported, your API key has no restrictions, the Generative Language API is enabled, and billing is active, yet you still receive a 403 error, check the official Google Cloud Service Health Dashboard to confirm there are no active service outages.

If services are fully operational, post your issue on the Google AI Developer Forums with your code's language, your hosting provider's region, and the exact error response payload for assistance from Google's engineering community.