Includes the auth-key migration

Gemma 4 API & API Key

Gemma's weights are open, but you don't have to host them. Google serves Gemma 4 through the Gemini API - and charges nothing per token for it. Here's how to get a key, call the models, and not leak your credentials in the process.

Get an API key Code examples Compare providers

Free tier needs no billing account · Weights remain Apache 2.0 if you'd rather self-host

60-second start

# 1. Key from aistudio.google.com/apikey
export GEMINI_API_KEY="AIza…"

# 2. Install
pip install google-genai

# 3. Call it
from google import genai
c = genai.Client()
r = c.models.generate_content(
  model="gemma-4-31b-it",
  contents="Hello!")
print(r.text)

Cost$0 / tokenrate-limited

Context262,144tokens

Billingnot requiredfree tier

First, a clarification

There isn't a separate "Gemma API"

This trips people up constantly. Gemma 4 is a set of open weights, not a hosted product with its own console. When people say "the Gemma 4 API" they mean one of three different things.

☁️

Google's Gemini API

Google hosts Gemma 4 alongside its Gemini models, reachable with the same SDK, the same endpoint and one API key from AI Studio. This is what most people mean, and it's the path this page covers first.

🔀

Third-party hosts

OpenRouter, Fireworks, DeepInfra, Together, Cerebras and a dozen others serve the same open weights behind OpenAI-compatible endpoints. Useful for redundancy, higher limits, or models Google doesn't host.

🏠

Your own endpoint

Run the weights yourself with vLLM, Ollama or SGLang and you get an OpenAI-compatible API on your own infrastructure. No key, no rate limit, no data leaving your network - you just pay for the hardware.

💡

Which should you use? Start with the Gemini API - it's free, needs no billing account, and takes about a minute to set up. Move to a third-party host when you hit rate limits or want a model Google doesn't serve, and self-host when data residency, cost at scale, or offline operation matters more than convenience.

Step by step

Getting an API key

Free, no credit card, about sixty seconds. You need a Google account and nothing else.

Open Google AI Studio

Go to aistudio.google.com/apikey and sign in. AI Studio is the console for the Gemini API - Gemma models are served through the same infrastructure, so there's no separate signup.

Create the key

Click Create API key, and pick a project when prompted. New keys are issued as auth keys - bound to a service account and restricted to the Gemini API by default, which is what you want. They begin AIza….

Put it in your environment, not your code

The SDK reads GEMINI_API_KEY automatically, so you never need to write the key into a source file.

# macOS / Linux - add to ~/.zshrc or ~/.bashrc to persist
export GEMINI_API_KEY="AIza…"

# Windows PowerShell
setx GEMINI_API_KEY "AIza…"

🔑

If you already have a key, check it - the rules changed in 2026

Google is retiring legacy "standard" API keys in favour of auth keys, after a spate of key-leak abuse. This is already enforced, not a future plan.

Already in effect Unrestricted standard keys are rejected

If a legacy key isn't restricted to the Gemini API, the API refuses the request outright. Dormant unrestricted keys began getting blocked on May 7, 2026.

September 2026 All standard keys stop working

After that, the Gemini API rejects every remaining standard key regardless of restrictions. Migrating means creating a new auth key and swapping it in.

The fix Create a fresh key, or add restrictions

In AI Studio, either click Create API key for a new auth key, or find the legacy key and choose Add restrictions → Restrict to Gemini API only.

Quickstart

Calling Gemma 4

Gemma uses the same google-genai SDK and the same endpoint as Gemini - only the model ID changes.

pip install google-genai

# Reads GEMINI_API_KEY from the environment automatically
from google import genai
from google.genai import types

client = genai.Client()

response = client.models.generate_content(
    model="gemma-4-31b-it",
    contents="Explain mixture-of-experts routing in three sentences.",
    config=types.GenerateContentConfig(
        system_instruction="You are a precise technical writer.",
        temperature=0.7,
        max_output_tokens=1024,
        thinking_level="high",   # "high" or "minimal"
    ),
)

print(response.text)

curl "https://generativelanguage.googleapis.com/v1beta/models/gemma-4-31b-it:generateContent" \
  -H "x-goog-api-key: $GEMINI_API_KEY" \
  -H "Content-Type: application/json" \
  -X POST \
  -d '{
    "contents": [
      {"parts": [{"text": "Explain mixture-of-experts routing briefly."}]}
    ],
    "generationConfig": {
      "temperature": 0.7,
      "maxOutputTokens": 1024
    }
  }'

# Pass the key as a header, never as a ?key= query parameter -
# query strings end up in server logs, proxies and browser history.

npm install @google/genai

import { GoogleGenAI } from "@google/genai";

// Server-side only. Never ship this in browser code.
const ai = new GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });

const response = await ai.models.generateContent({
  model: "gemma-4-31b-it",
  contents: "Summarise the tradeoffs of 4-bit quantisation.",
  config: {
    systemInstruction: "Answer in bullet points.",
    temperature: 0.7,
  },
});

console.log(response.text);

from google import genai

client = genai.Client()

# Tokens arrive as they're generated - much better perceived latency
stream = client.models.generate_content_stream(
    model="gemma-4-31b-it",
    contents="Write a short essay on open weights.",
)

for chunk in stream:
    if chunk.text:
        print(chunk.text, end="", flush=True)

from google import genai
from google.genai import types

client = genai.Client()

def get_weather(city: str) -> dict:
    """Return the current weather for a city.

    Args:
        city: Name of the city.
    """
    return {"city": city, "temp_c": 18, "summary": "Overcast"}

# The SDK reads the signature and docstring to build the schema,
# then calls the function automatically when the model asks for it.
response = client.models.generate_content(
    model="gemma-4-31b-it",
    contents="What's the weather in Colombo?",
    config=types.GenerateContentConfig(tools=[get_weather]),
)

print(response.text)

# Third-party hosts speak the OpenAI protocol, so any OpenAI client works.
from openai import OpenAI

client = OpenAI(
    base_url="https://openrouter.ai/api/v1",
    api_key=os.environ["OPENROUTER_API_KEY"],
)

resp = client.chat.completions.create(
    model="google/gemma-4-31b-it",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(resp.choices[0].message.content)

# Same pattern works against your own vLLM or Ollama server:
#   base_url="http://localhost:11434/v1", api_key="ollama"

Model IDs

What's actually hosted

Not every Gemma 4 size is available as a hosted API. These are the IDs Google documents for the Gemini API - for anything else, use a third-party host or run it yourself.

Model ID	Size	Context	Modalities	Where
`gemma-4-31b-it`	31B dense	262,144	Text + image	Gemini API
`gemma-4-26b-a4b-it`	26B MoE	262,144	Text + image + video	Gemini API
`google/gemma-4-31b-it`	31B dense	262,144	Text + image	OpenRouter
`google/gemma-4-26b-a4b-it`	26B MoE	262,144	Text + image + video	OpenRouter
`gemma-4-e4b-it`	E4B edge	128K	Text + image + audio	Fireworks

⚠️

The 12B is not in Google's documented hosted list. Some third-party sites list gemma-4-12b-it as a Gemini API model, but Google's own documentation names only the 31B and 26B A4B. If you need the 12B's native audio input over an API, use a third-party host or self-host it - and check Google's model list before building on the assumption it's there.

Cost

What it costs

Gemma 4 is unusually cheap to call, because the weights are free and providers compete on serving them. Google charges nothing at all.

Provider	Model	Input / 1M	Output / 1M	Notes
Google Gemini API	31B · 26B A4B	$0.00	$0.00	Free of token charges, subject to rate limits
OpenRouter free tier	31B · 26B A4B	$0.00	$0.00	`:free` slugs, 32K max output, heavily rate-limited
OpenRouter	26B A4B	$0.07	$0.34	Routes across ~10 providers
OpenRouter	31B	$0.08	$0.35	Routes across ~16 providers
Fireworks	E4B	$0.20	$0.20	Currently the only E4B host
Self-hosted	Any size	-	-	Weights free; you pay for GPU time only

Rates checked August 2026 and they move often - treat this as a starting point and confirm on the provider's own pricing page before committing to a budget. Note that Gemma is not listed on Google's published Gemini API pricing table at all, which is consistent with it being free but means there's no official rate to point at.

🆓

Free tier is genuinely usable

No billing account required. It's rate-limited rather than credit-limited, so prototypes, side projects and evaluation work rarely cost anything at all.

🔒

Free tiers and your data

Free usage of the Gemini API generally allows your prompts to be used to improve Google's products; paid tiers don't. If your inputs are sensitive, that distinction matters more than the price does.

📉

When self-hosting wins

At steady high volume a rented GPU beats per-token pricing, and the crossover comes sooner than people expect. Below that, hosted APIs are almost always cheaper than an idle GPU.

Do not skip this

Keeping your key safe

Leaked API keys are the single most common way people get an unexpected bill or a suspended project. Scrapers watch public repositories continuously, and a committed key is usually found in minutes.

Safe handling

✅ Read keys from environment variables
✅ Add .env to .gitignore before the first commit
✅ Restrict every key to the Gemini API
✅ Use Secret Manager or your platform's secret store in production
✅ Add IP or origin restrictions where you can
✅ Turn on billing alerts, even on a free tier
✅ Rotate keys periodically, and immediately after any exposure

Don't

Ways keys leak

⚠️ Hardcoding a key in source, then committing it
⚠️ Shipping a key in a web or mobile app - anyone can read it
⚠️ Passing it as ?key= in a URL, where logs capture it
⚠️ Pasting it into an issue, a screenshot, or a chat message
⚠️ Sharing one key across every environment and teammate
⚠️ Assuming deleting a commit removes it - git history keeps it

🚨

Front-end apps must not hold the key. Anything in browser or mobile code can be extracted, however well minified - "hidden" in a bundle is not hidden. Put a small server between your app and the API, keep the key there, and add your own auth and rate limiting. The example below is the whole pattern.

// server.js - the key lives here, never in the browser
import express from "express";
import { GoogleGenAI } from "@google/genai";

const app = express();
const ai = new GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });

app.post("/api/chat", express.json(), async (req, res) => {
  // Authenticate YOUR user and rate-limit them here first.
  if (!isAuthorised(req)) return res.status(401).end();

  const out = await ai.models.generateContent({
    model: "gemma-4-31b-it",
    contents: req.body.prompt,
  });
  res.json({ text: out.text });
});

app.listen(3000);

// The browser calls /api/chat. It never sees GEMINI_API_KEY.

🔧

If a key does leak: create a replacement first, deploy it, and only then disable the old key - revoking before you've swapped it just takes your app down. Afterwards, check your usage and billing logs for activity you don't recognise, and remember that rewriting git history is required to actually remove the key from a repository.

Capabilities

What works over the API

Gemma 4 supports nearly everything Gemini does through the same interface.

📋

System instructions

Native support via system_instruction - set a role and output format once for the whole conversation.

🛠️

Function calling

Pass Python functions directly and the SDK builds the schema and handles the call loop for you.

🖼️

Image understanding

Send images alongside text. The 26B A4B additionally accepts video.

🧠

Thinking mode

Set thinking_level to "high" or "minimal" to trade latency for reasoning depth.

💬

Multi-turn chat

Use the chat interface and the SDK maintains history for you across turns.

⚡

Streaming

generate_content_stream yields tokens as they're produced, which transforms perceived latency.

🔍

Search grounding

Ground answers in Google Search results - useful given the January 2025 training cutoff.

📐

Structured output

Constrain responses to a JSON schema so you can parse them without defensive string handling.

FAQ

Common questions

Is the Gemma 4 API really free?

Google charges nothing per token for Gemma models on the Gemini API, and the free tier needs no billing account. What limits you is throughput, not spend - requests per minute, tokens per minute and requests per day, which rise as your project moves into paid tiers.

Worth noting: Gemma isn't listed on Google's published pricing table at all. That's consistent with it being free, but it also means there's no official rate to cite, so verify before you build a business case on it.

Do I need a credit card?

Not for the free tier. You'll need a billing account only to reach the higher rate limits of Tier 1 and above, or if you want the data-handling terms that come with paid usage.

Which model ID should I use?

gemma-4-31b-it for maximum quality, gemma-4-26b-a4b-it when you want speed - the MoE activates only about 3.8B parameters per token, so it responds noticeably faster at similar quality. Both give you a 262,144-token context.

Can I call the API from my front-end?

Not with your key in it, no. Anything shipped to a browser or mobile app can be extracted, and a leaked key is someone else's quota on your project.

Put a thin server in between - it holds the key, authenticates your own users, and rate-limits them. There's a complete example in the security section above.

My key stopped working - what happened?

Most likely the auth-key migration. Unrestricted legacy "standard" keys are already rejected, and all standard keys stop working in September 2026. Open AI Studio and either create a new key or restrict the existing one to the Gemini API.

What are the rate limits?

They're tied to your project's usage tier and Google adjusts the published figures periodically, so any number quoted here would go stale. Check the rate-limits page in the Gemini API docs for current values. Tiers rise automatically as spending accumulates.

Is my data used for training?

On the free tier, Google may use your prompts and responses to improve its products. Paid tiers don't. If you're handling anything confidential, that difference is the main argument for paying - or for self-hosting, where the question doesn't arise.

Why use a third-party host instead of Google?

Higher or differently-shaped rate limits, access to sizes Google doesn't host such as E4B, provider redundancy through OpenRouter's routing, or simply keeping every model behind one OpenAI-compatible interface. The tradeoff is that you're paying per token for weights Google serves for free.

Can I use the OpenAI SDK?

With third-party hosts and your own vLLM or Ollama server, yes - just change base_url. For Google's own API, use the google-genai SDK, which is the documented path for Gemma there.

Key in hand?

Try the models in a local playground first, or grab the weights and skip the API entirely.

Get an API key Open the playground Download the weights