{"record":{"id":"cae4696834502151","repo":"vercel/ai","slug":"google-generative-ai-api-key-is-required-for-realt","errorCode":null,"errorMessage":"Google Generative AI API key is required for realtime token creation.","messagePattern":"Google Generative AI API key is required for realtime token creation\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/google/src/realtime/google-realtime-model.ts","lineNumber":61,"sourceCode":"\n  private readonly config: GoogleRealtimeModelConfig;\n  private readonly mapper = new GoogleRealtimeEventMapper();\n\n  constructor(modelId: string, config: GoogleRealtimeModelConfig) {\n    this.modelId = modelId;\n    this.provider = config.provider;\n    this.config = config;\n  }\n\n  async doCreateClientSecret(\n    options: RealtimeModelV4ClientSecretOptions,\n  ): Promise<RealtimeModelV4ClientSecretResult> {\n    const fetchFn = this.config.fetch ?? fetch;\n    const headers = this.config.headers();\n    const apiKey = headers['x-goog-api-key'];\n\n    if (!apiKey) {\n      throw new Error(\n        'Google Generative AI API key is required for realtime token creation.',\n      );\n    }\n\n    // `newSessionExpireTime` controls how long the token can be used to *open*\n    // a session — the window callers actually care about — so map\n    // `expiresAfterSeconds` to it (Google otherwise defaults it to ~60s).\n    // `expireTime` is the overall token lifetime and must be >=\n    // `newSessionExpireTime`, so extend it to leave room for the opened session\n    // to run.\n    const now = Date.now();\n    const openWindowMs = (options.expiresAfterSeconds ?? 60) * 1000;\n    const newSessionExpireTime = new Date(now + openWindowMs).toISOString();\n    const expireTime = new Date(\n      now + openWindowMs + 30 * 60 * 1000,\n    ).toISOString();\n\n    const setupPayload = buildGoogleSessionConfig(","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/google/src/realtime/google-realtime-model.ts#L43-L79","documentation":"doCreateClientSecret mints ephemeral auth tokens for Google realtime (Live API) WebSocket sessions by calling the v1alpha auth_tokens endpoint. That request authenticates with the provider API key read from the 'x-goog-api-key' header in the provider config; if no key is present it throws before making any network call. The Google provider always sets this header from createGoogleGenerativeAI({ apiKey }) or GOOGLE_GENERATIVE_AI_API_KEY.","triggerScenarios":"Invoking clientSecret creation on a realtime model (e.g. experimental_createClientSecret) while the provider was configured without an API key — apiKey env var unset, undefined passed explicitly, or headers overridden to drop x-goog-api-key.","commonSituations":"Missing GOOGLE_GENERATIVE_AI_API_KEY in the environment (serverless deploy, CI, .env not loaded); passing apiKey: undefined; using a custom headers() function that omits the key.","solutions":["Set process.env.GOOGLE_GENERATIVE_AI_API_KEY or pass apiKey in createGoogleGenerativeAI({ apiKey }).","Verify the env var is actually loaded in the runtime (print presence, not value, at startup).","If using custom headers, ensure the headers() function includes 'x-goog-api-key'.","For browser apps, mint the secret server-side where the key exists, then hand the token to the client."],"exampleFix":"// before\nconst google = createGoogleGenerativeAI({ apiKey: undefined });\n// after\nconst google = createGoogleGenerativeAI({\n  apiKey: process.env.GOOGLE_GENERATIVE_AI_API_KEY,\n});","handlingStrategy":"validation","validationCode":"const apiKey = process.env.GOOGLE_GENERATIVE_AI_API_KEY;\nif (!apiKey) throw new Error('GOOGLE_GENERATIVE_AI_API_KEY must be set before creating realtime client secrets');","typeGuard":null,"tryCatchPattern":"try {\n  const secret = await model.createClientSecret(options);\n} catch (error) {\n  if (error instanceof Error && error.message.includes('API key is required')) {\n    // surface a configuration error to the operator, not the end user\n  } else { throw error; }\n}","preventionTips":["Set GOOGLE_GENERATIVE_AI_API_KEY in every environment (CI, serverless, local .env).","Fail fast at startup: verify the key's presence before serving traffic.","For browser realtime apps, mint client secrets on the server where the key exists.","Avoid custom headers() implementations that drop x-goog-api-key."],"tags":["api-key","authentication","google","realtime","config"],"backgroundTag":"missing-api-key","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}