How to secure a Gemini API key in Python

The Problem

This is what most Python codebases look like today. The GOOGLE_AI_API_KEY key (AIza...) lives directly in the process environment. If your repo, your CI logs, or your deployment config leaks — so does your key.

# gemini.py — real Google AI key in environment
import os
import google.generativeai as genai

genai.configure(api_key=os.environ["GOOGLE_AI_API_KEY"])  # AIzaSy...
model = genai.GenerativeModel("gemini-3.5-flash")

def generate_content(prompt: str) -> str:
    response = model.generate_content(prompt)
    return response.text

The Fix

Send the request to the KeyVault Edge proxy at https://proxy.keyvaultedge.com with the provider's usual path, your kvt_ token in X-KV-Token and the provider's base URL in X-KV-Target. The proxy refuses requests whose Origin isn't on the token's allowed hosts, then injects your real GOOGLE_AI_API_KEY, so it never sits in your app's environment.

# gemini.py — KVE_TOKEN is host-bound; Google AI key not in process
import os
import httpx

KVE_TOKEN = os.environ["KVE_TOKEN"]

def generate_content(prompt: str) -> str:
    response = httpx.post(
        "https://proxy.keyvaultedge.com/v1beta/models/gemini-3.5-flash:generateContent",
        headers={
            "X-KV-Token": os.environ["KVE_TOKEN"],  # kvt_... token
            "X-KV-Target": "https://generativelanguage.googleapis.com",
            # Must match one of the token's allowed hosts
            "Origin": os.environ["APP_ORIGIN"],
            "Content-Type": "application/json",
        },
        json={
            "contents": [{"parts": [{"text": prompt}]}]
        },
        timeout=30.0,
    )
    response.raise_for_status()
    return response.json()["candidates"][0]["content"]["parts"][0]["text"]

Setup in 4 steps

# .env
KVE_TOKEN=kvt_...your_token
APP_ORIGIN=https://yourdomain.com  # one of the token's allowed hosts

pip install httpx
# pip uninstall google-generativeai  # optional

What this protects, and what it doesn't

• Your real GOOGLE_AI_API_KEY stays at the edge, so it can't leak from your repo, logs, bundle or server environment.
• The kvt_ token is still a credential. A copied token can be replayed by anyone who can send the right headers, including a fake Origin from a server. The protection is that each token has its own rate limits, monthly cost cap and endpoint scope, and you can revoke it in one click without rotating the provider key.
• The cost cap is estimated from the usage the provider reports, so a request already in flight can overshoot it slightly.

Already leaked a Gemini key? Read what to do in the first hour. Plans and limits are on the pricing page.

More Google AI guides