{"slug": "gemini-api-cli-official-guide-part-2-keyless-adc-oauth-scope-troubleshooting", "title": "Gemini API CLI Official Guide (Part 2): Keyless ADC, OAuth Scope Troubleshooting & User Tier Economics", "summary": "A developer published a second-part guide to the Gemini API CLI (v0.4.6) documenting keyless OAuth via Application Default Credentials, where short-lived bearer tokens are minted from existing identity and paired with an explicit x-goog-user-project header to attribute quota and billing to a designated GCP project. The guide also troubleshoots HTTP 403 OAuth scope errors observed at runtime and clarifies that Google AI Pro/Ultra consumer subscriptions do not make Developer API calls free, since the API bills against a GCP project rather than a Google Account. Source inspection of the release found no native ADC discovery or token auto-refresh, so credentials must be supplied via GEMINI_ACCESS_TOKEN or --access-token and injected through environment variables rather than command-line flags.", "body_md": "**Verified baseline**: `2026-11-14` (Asia/Taipei, UTC+8) on macOS Apple Silicon (`ts-m1`), `gemini-api 0.4.6`, plus our `2026-11-15` live execution on `gde-jimmyliao-redeem` summarized in Section 10. Runtime HTTP 403 scope diagnostics and Paid Tier live execution are observed tool outputs; pricing, quota, and consumer migration boundaries come directly from official Google documentation.\n\n📚 **Series Navigation**\n\n- 📘\n**Part 1 (Dev.to)**: [https://dev.to/jimmyliao/gemini-api-cli-official-guide-part-1-giving-your-ai-agent-a-stateless-multimodal-cli-toolbox-36p3](https://dev.to/jimmyliao/gemini-api-cli-official-guide-part-1-giving-your-ai-agent-a-stateless-multimodal-cli-toolbox-36p3)\n- 📝\n**Part 1 (Substack)**: [https://memo.jimmyliao.net/p/gemini-api-cli-part-1-agent-api](https://memo.jimmyliao.net/p/gemini-api-cli-part-1-agent-api)\n- 🇹🇼\n**Part 2 (Substack, Traditional Chinese)**: [https://memo.jimmyliao.net/p/gemini-api-cli-part-2keyless-adcscope](https://memo.jimmyliao.net/p/gemini-api-cli-part-2keyless-adcscope)\n- ▶️\n**YouTube 16:9 Walkthrough (Part 1)**: [https://youtu.be/Rb5ij419w2Y](https://youtu.be/Rb5ij419w2Y)\n- ⚡\n**YouTube Shorts (Part 1)**: [https://youtube.com/shorts/82-Z_Jq-ezQ](https://youtube.com/shorts/82-Z_Jq-ezQ)\n\n[Part 1](https://dev.to/jimmyliao/gemini-api-cli-official-guide-part-1-giving-your-ai-agent-a-stateless-multimodal-cli-toolbox-36p3) introduced the standalone multimodal CLI. Once AI agents operate across laptops, containers, and CI runners, two architectural questions immediately arise:\n\n`AIza*` API keys on disk while attributing every request cleanly to a designated GCP project?\nKeyless OAuth answers the first question by minting short-lived bearer access tokens from your existing identity and attaching an explicit quota project header. Importantly, **keyless does not mean credential-less**: local ADC still stores an underlying refresh credential, short-lived bearer tokens remain secrets, and OAuth never bypasses IAM roles, API enablement, or Cloud Billing.\n\nA second widespread misconception is *\"I pay for Google AI Pro / Ultra, so logging in with that Google account makes Gemini API calls free.\"* Your Google Account is an identity; Google One / Antigravity is a **consumer subscription pool**; the Developer API (`generativelanguage.googleapis.com`) belongs to a **GCP project / Cloud Billing pool**. Even promotional or GDE credits must be checked per billing account, eligible SKU, and expiration date.\n\nPrimary evidence lives in `experiments/03-part2-keyless-adc/results.md`, `experiments/04-tier-limits-and-errors/tier-research.md`, and `gde-feedback/upstream-issues-draft.md`.\n\n`v0.4.6` Implements Keyless OAuth\nTo verify exact release behavior rather than relying on an earlier snapshot, we inspected four source files directly in tag `v0.4.6`:\n\n| Source File ( `v0.4.6` ) | Observed Responsibility & Limitation | \n|---|---|\n| `internal/cli/auth.go` | `runAuthLoginCmd` persists an existing API key or access-token string via`config.StoreSecret` /`config.SaveConfig` ; it never launches a browser OAuth flow or acquires refresh credentials. | \n| `internal/config/config.go` | `SecurityConfig.AccessToken` maps to YAML`access_token` across flags, env vars, OS Keychain, and`~/.config/gemini-api/config.yaml` (not`config.json` ). | \n| `internal/cli/configure.go` | `runConfigureCmd` writes credentials and global parameters including`user-project` locally. | \n| `internal/client/client.go` | `BuildGlobalSecurity` selects API key or access token;`buildGlobalOptions` maps`user-project` to`sdk.WithUserProject` . No native ADC discovery or token auto-refresh source exists here yet. | \n\n`GEMINI_ACCESS_TOKEN` / `--access-token` supplies the bearer credential (*who is calling*), whereas `--user-project` sets the `x-goog-user-project` header (*which GCP project owns quota & billing*). Never pass tokens on the command line where process inspection (`ps`) can read them—inject via subprocess environment variables instead.\n\nGeneral credential precedence follows `flag -> environment -> Keychain -> config`, and the Go client picks a complete explicit credential over fallback paths. Therefore our wrapper unsets inherited `GEMINI_API_KEY` variables before injecting a fresh ADC access token. Merely setting `GOOGLE_APPLICATION_CREDENTIALS` does **not** make `v0.4.6` discover or refresh ADC natively. See [OAuth quickstart](https://aistudio.google.com/docs/oauth) and [API CLI docs](https://aistudio.google.com/docs/cli).\n\n`ts-m1`: `HTTP 403 ACCESS_TOKEN_SCOPE_INSUFFICIENT`\nOn `ts-m1`, the active gcloud/ADC identity `sjliao@gmail.com` (`authorized_user`, `quota_project_id: leapcore-dev`) held `cloud-platform`, `sqlservice.login`, `userinfo.email`, `email`, and `openid`—but **lacked** `https://www.googleapis.com/auth/generative-language`:\n\n| Live Call Tested | Process Exit | HTTP / Error Reason | Engineering Conclusion | \n|---|---|---|---|\n| `models list` (no project header) | `3` | `403 ACCESS_TOKEN_SCOPE_INSUFFICIENT` | Default Cloud ADC token lacks `generative-language` scope | \n| `models list --user-project gdg-kc-465418` | `3` | Same | Switching `--user-project` cannot fix a token scope gap | \n| `generate` with`gdg-kc-465418` | `3` | `403 PERMISSION_DENIED` / same reason | Zero inference response or usage incurred | \n| Wrapper `generate` with`leapcore-dev` | `3` | Same | `billingEnabled=true` cannot compensate for missing OAuth scope | \n\n```\ngcloud auth application-default login --scopes=\"https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/generative-language,https://www.googleapis.com/auth/generative-language.retriever,https://www.googleapis.com/auth/userinfo.email,openid\"\n```\n\nNote why all of those scopes appear: the official `/docs/oauth` guide demonstrates `cloud-platform` + `generative-language.retriever`, whereas live `generate` calls explicitly requested `https://www.googleapis.com/auth/generative-language`. If Google's default gcloud client blocks sensitive scopes for your workspace or account, create a **Desktop app** OAuth Client in Google Cloud Console (configuring your consent screen / test users per [OAuth quickstart](https://aistudio.google.com/docs/oauth)), store `client_secret.json` outside the repo, and pass `--client-id-file <path>`:\n\n```\n./bin/gapi-adc --print-reauth\n# Re-authorization modifies local ADC and opens a browser:\n./bin/gapi-adc --reauth --client-id-file /secure/path/outside/repo/client_secret.json\n```\n\nScope is not IAM: the target quota project must also enable `generativelanguage.googleapis.com` and grant the caller `serviceusage.services.use`.\n\n`bin/gapi-adc`\n`bin/gapi-adc` calls `gcloud auth application-default print-access-token` right before live invocations, captures the short-lived token in memory, exports `GEMINI_ACCESS_TOKEN`, and `exec` s `gemini-api` without ever persisting tokens to disk or CLI config. (Long-running polling loops past token TTL still require a refreshing client or periodic re-invocation.)\n\nBecause `gemini-api v0.4.6` rejects `-p` (`exit 2: unknown shorthand flag`), the wrapper maps `-p` to `--user-project`. Project resolution order is: explicit `--user-project`/`-p` -> `GAPI_USER_PROJECT` -> scalar `user_project`/` user-project` in `~/.config/gemini-api/config.yaml` -> `gcloud core/project`.\n\n```\n./bin/gapi-adc --help\n./bin/gapi-adc --print-auth-status\n./bin/gapi-adc --print-reauth\n./bin/gapi-adc generate \"hi\" --dry-run\n./bin/gapi-adc generate \"hi\" --user-project gdg-kc-465418 --dry-run\n./bin/gapi-adc generate \"hi\" -p gdg-kc-465418 --dry-run\n```\n\n`--print-auth-status` safely inspects ADC `type` and `quota_project_id` (redacting refresh tokens/secrets), queries Google's tokeninfo endpoint via stdin so the token never appears in `curl` argv:\n\n```\ncurl -sS -m 15 -X POST -d @- https://oauth2.googleapis.com/tokeninfo\n```\n\nIt reports `PRESENT`/` MISSING` for both `generative-language` scopes, `expires_in`, and a masked email, returning **exit 0** even when scopes are missing (diagnostic mode—never treat exit 0 of `--print-auth-status` as CI auth proof). Normal execution exits `3` on token failure, `2` if no project is resolved, `127` on missing binaries, or passes through `gemini-api`'s exit code. `--dry-run` skips gcloud network calls completely.\n\n`sjliao@gmail.com`)\nInspecting the actual GCP projects under `sjliao@gmail.com` illustrates why `billingEnabled`, `OPEN` billing accounts, and API enablement must be verified separately:\n\n| Project ID(s) | `billingEnabled` / Billing Account | `generativelanguage.googleapis.com` Status | \n|---|---|---|\n| `jimmyliao-dev` ,`gcp-trial-423705` ,`gen-lang-client-0954497962` ,`bwai2026-jimmyliao` ,`bwai2026-jimmyliao-ws` ,`io26-496910` | `false` (`bwai2026-jimmyliao` retains historical linkage) | Listed enabled -> Free Tier candidates | \n| `gdg-kc-465418` | `true` (`0154CA-AF3D86-D7DE34` ) | Enabled -> `generate` blocked earlier by ADC scope 403 | \n| `gde-jimmyliao-redeem` ,`ai-course-2026` ,`helloworld2026-jimmyliao` | `true` (`GDE_Redeem` /`01FE1D-589853-A0397F` ) | Enabled -> Paid / Redeem candidates ( `gde-jimmyliao-redeem` verified live on`2026-11-15` ) | \n| `leapcore-dev` | `true` (same`GDE_Redeem` account) | Raw `gcloud services list --enabled` returned`Listed 0 items.` (contradicts earlier assumption) | \n| `jimmyliao-ai-proj` ,`bwai2026` ,`gdg-ws-0523` ,`gdgyep2026` | `false` | Not listed in enabled services | \n\nBilling account checks also confirmed both `gde-aipro-jimmy` (`013712-FCD5CC-34996C`) and `GDE_Redeem` (`01FE1D-589853-A0397F`) are `OPEN=True`, and showed why `cloudbilling.googleapis.com` on a consumer project sometimes needs `--billing-project=jimmyliao-dev` separately from `--user-project`.\n\n`GEMINI_ACCESS_TOKEN` + `--user-project <unbilled-project>` with `generativelanguage.googleapis.com` enabled and `serviceusage.services.use` IAM). See `UTC-7`) and `UTC-8`, active in November). Current general numeric quotas live behind the authenticated `200 RPM / 50,000 TPM / 10,000 RPD`, while `gemini-omni-1.2-flash` has | Capability | Free vs. Paid Boundary (per Official Docs) | \n|---|---|\n| Text / Multimodal Input Analysis | Selected models offer Free Tier; free multimodal *input* does not imply free image/video*output* | \n| Image Generation | `gemini-3.1-flash-image` (`Nano Banana 2` ) &`gemini-nano-banana-2.1` list API Free Tier as**Not available** (AI Studio UI previews do not grant programmatic Free quota) | \n| Text-to-Speech (TTS) | `gemini-3.8-flash-tts` ,`3.1 Flash TTS Preview` , and`2.5 Flash Preview TTS` allow Free**Standard** ;**Batch** has no Free Tier | \n| Video Generation | Current `gemini-omni-1.2-flash` is**paid-only** ; legacy`Veo 3.1 Preview` shut down on**`2026-10-22`** (Veo GA lives in Enterprise Agent Platform, a separate surface) | \n| Search Grounding | Not strictly paid-only: `2.5 Flash` Standard offers`500 RPD` free (shared with Flash-Lite); Gemini 3+ models include`5,000` monthly free Search requests then`$14 / 1,000` , capped at`1,500 RPD` per project by default | \n| Batch / Context Caching | No Free Tier for explicit context caching or Batch on checked models ( `2.5 Flash` ); paid Batch offers independent enqueue quotas | \n| Managed / Deep Research Agents | Billed at underlying token rates + tool fees—not bundled in Google One subscriptions | \n\n`store=false` disables state persistence (incompatible with `background` execution) but does not override Unpaid terms. See | Tier | Official Qualification Criteria | Monthly Spend Cap per Billing Account | \n|---|---|---|\n| **Tier 1** | Linked active Cloud Billing account; Prepay requires minimum **$5 USD** top-up (eligible accounts may use Postpay) | **$250 USD** | \n| **Tier 2** | **$100 USD** paid spend +**3 days** since first successful payment | **$2,000 USD** | \n| **Tier 3** | **$1,000 USD** paid spend +**30 days** since first successful payment | **$20,000 – $100,000+ USD** (varies by account) | \n\nCumulative spend aggregates Google Cloud services spend across the linked billing account (upgrades trigger automatically after review: near-instant Free -> Tier 1, ~10 min afterward). Paid Tier 1 also enforces a **rolling 10-minute spend rate limit** of **$10 USD** (Tier 2/3: **$200 USD**), which protects against runaway retries (`429`).\n\nRegarding **GDE / Cloud Credits & Prepay**: promotional credits only offset eligible Gemini API SKUs on the matching billing account before expiration. New **$300 GCP Welcome Free Trial credits** (since March 2026) exclude Gemini API except grandfathered balances within 90 days, and promotional credits alone may not satisfy paid-spend tier upgrade criteria ([billing](https://aistudio.google.com/docs/billing#cloud-credits-prepay)). Prompts sent through active-billing Paid projects are **not** used to improve Google products ([Paid Services terms](https://aistudio.google.com/docs/terms#paid-services)).\n\n| Modality | Pricing Notes from Docs ( `2026-11-14/15` ) | \n|---|---|\n| Text / Multimodal Understanding | `2.5 Flash` :`$0.30 / 1M` text/image/video input,`$1 / 1M` audio input,`$2.50 / 1M` output (deprecated; auto-routes to`3.5 Flash-Lite` on`2026-12-01` ). Current`gemini-3.8-flash` :`$0.75 / 1M` in,`$3.75 / 1M` out+thinking (through`2026-12-31` ). | \n| `image` (`3.1 Flash` /`Nano Banana 2.1` ) | Legacy `3.1 Flash Image` :`$0.067` (1K); current default`gemini-nano-banana-2.1` :`$1.50 / 1M` in,`$7.50 / 1M` text+thinking out,`$30 / 1M` image out (`1,120 tokens = $0.0336` per 1K image). | \n| `video` (`gemini-omni-1.2-flash` ) | `$1.50 / 1M` in,`$9.00 / 1M` text out,`$12.00 / 1M` video out (`5,792 tokens/s @ 720p` ≈**`$0.07/s`** ). | \n| `tts` (`gemini-3.8-flash-tts` ) | Through `2026-12-31` :`$0.50 / 1M` text input,`$9.00 / 1M` audio output (`25 tokens/s` ≈`$0.00225 / 10s` ); doubles starting`2027-01-01` . | \n| Deep Research / Managed Agents | Underlying model input/output + reasoning-loop intermediate tokens + tool fees; managed sandbox compute currently $0 in preview. | \n| Batch Tier | Typically **50% off** standard token rates on supported models (not applied to every tool/storage fee). | \n\nEffective **2026-06-18**, individual Pro/Ultra subscriptions moved from `gemini-cli` to `agy`, featuring **5-hour rolling quotas bounded by weekly caps** (and optional AI Credits overage inside Antigravity). Because those credits sit strictly inside the consumer/Antigravity pool, logging into `gcloud` with a Pro/Ultra account does **not** transfer free API quota to `gemini-api`.\n\nThe **Golden Hybrid Pattern** resolves this cleanly:\n\n`agy`'s subscription pool.` image`, `video`, `music`, `tts`) through `gapi-adc` to explicitly governed Free or Paid GCP projects.\nIn planning our 15-second Reels pipeline:\n\n`jimmyliao-dev`)` generate` storyboard, Standard single `analyze` QA), while `omni-1.2-flash` video remain `gdg-kc-465418` / `gde-jimmyliao-redeem`)\n| Item Estimated Pre-Run | Initial Planning Estimate & Constraint | \n|---|---|\n| `3.1 Flash Image` 1K (prior baseline) | `~$0.067 / image × 3 ≈ $0.201` (v0.4.6 actually defaults to`gemini-nano-banana-2.1` ) | \n| `Omni 1.2 Flash` 720p video | `~$0.07 / s × 15s = $1.05` + input tokens | \n| `3.8 Flash TTS` | `$0.50 / 1M` text in,`$9.00 / 1M` audio out | \n| Strategy Safeguard | **Keyframe-First** : inspect 9:16 image keyframes (`~$0.05` ) manually before paying for video motion (`~$0.35 / 5s` ) to avoid tripping Tier 1's`$10` rolling 10-minute cap | \n\n`sample-part2-adc-tier-router.sh`)\nOffline project-attribution router dry-run (add `--check-live-token` locally for live ADC scope diagnostics; source: `examples/part2-keyless-adc-tiers/sample-part2-adc-tier-router.sh`):\n\n```\nbash <<'PART_SAMPLE'\n(\nset +x\nset -euo pipefail\ncd examples/part2-keyless-adc-tiers\nunset GEMINI_API_KEY GEMINI_ACCESS_TOKEN GEMINI_ENVIRONMENT_KEY GEMINI_USER_PROJECT\nexport GEMINI_NO_KEYRING=true\nR=../reels-storyboard-pipeline\nW=../../bin/gapi-adc\nFREE_PROJECT_ID=${FREE_PROJECT_ID:-jimmyliao-dev}\nPAID_PROJECT_ID=${PAID_PROJECT_ID:-gdg-kc-465418}\ncase \"${1:-}\" in\n '') echo 'Offline dry-run: skipping live token and network calls.' >&2 ;;\n --check-live-token) \"$W\" --print-auth-status </dev/null ;;\n *) echo 'Usage: sample-part2-adc-tier-router.sh [--check-live-token]' >&2; exit 2 ;;\nesac\n\"$W\" --print-reauth </dev/null\nverify_project() {\n local project=$1\n shift\n \"$W\" --agent-mode \"$@\" -p \"$project\" --dry-run </dev/null |\n python3 -c 'import json,sys; d=json.load(sys.stdin); h=d[\"request\"][\"headers\"][\"X-Goog-User-Project\"]; assert h == [sys.argv[1]], h; print(json.dumps(d,ensure_ascii=False)); print(\"Verified project header: \"+sys.argv[1],file=sys.stderr)' \"$project\"\n}\necho 'Stage A: Free candidate pre-production (requires online entitlement check separately)' >&2\nverify_project \"$FREE_PROJECT_ID\" generate 'Plan a 3-scene 9:16 Reels storyboard' --stream=false\nverify_project \"$FREE_PROJECT_ID\" tts 'Welcome to the Multimodal CLI' --out /tmp/part2-voice.wav\nverify_project \"$FREE_PROJECT_ID\" analyze -i \"$R/fixtures/scene1-keyframe.png\" 'Inspect layout safe-zone'\necho 'Stage B: Paid render dry-run, Keyframe before Video' >&2\nverify_project \"$PAID_PROJECT_ID\" image '9:16 tech Reels keyframe' --aspect-ratio 9:16 --image-size 1K --output-mime-type image/jpeg --out /tmp/part2-keyframe.jpg\nverify_project \"$PAID_PROJECT_ID\" video 'Slow camera push on keyframe' --aspect-ratio 9:16 --resolution 720p -i \"$R/fixtures/scene1-keyframe.png\" --out /tmp/part2-video.mp4\necho 'Guardrail: Approve keyframe before video render to protect Tier 1 rolling 10-min $10 cap.' >&2\n)\nPART_SAMPLE\n```\n\n| Persona | Authentication | Billing Pool | Quota Reset | Data Privacy | Available Features | Recommended CLI Combo | \n|---|---|---|---|---|---|---|\n| **Free** | AI Studio key, or ADC token + unbilled `--user-project` | Project Free quota (no Google One transfer) | RPM/TPM; RPD 15:00 PDT / 16:00 PST (Taipei) | Taiwan Unpaid terms allow product training & review; no confidential data | Selected text/analyze/TTS/Grounding; image/video/Batch/cache restricted | Any coding agent + `gemini-api` Free (select Free models) | \n| **Paid Tier 1–3** | Key / auth key, or ADC token + billed `--user-project` | Cloud Billing / Prepay / eligible GDE & Cloud credits | Same RPD + rolling 10-min cap ($10/$200) & billing cap | Paid prompts not used to train Google models; compliance logging applies | Image, video, Managed Agents, Batch, caching per model unlock | Coding agent + `gemini-api` ADC; pin CLI & project in CI | \n| **Pro / Ultra** | `agy` personal OAuth; separate key/ADC for API | `agy` 5H + weekly pool (+ optional AI Credits); separate API pool | `agy` 5H bounded by weekly cap; API per-project | `agy` consumer terms vs. Free/Paid project API terms | `agy` coding/Argon; offload specialized multimodal tasks to API | **Golden Hybrid** :`agy` +`gemini-api` | \n\nDocumented CLI exit codes: `0` success, `1` runtime/API error, `2` usage/validation, `3` auth/authorization. Always inspect both HTTP status and `reason`:\n\n| HTTP Status / Reason | Next Action | Evidence Type | \n|---|---|---|\n| `403 ACCESS_TOKEN_SCOPE_INSUFFICIENT` | Run `--print-auth-status` , then re-authorize scopes (`--reauth` ); do not swap billing projects to fix scope | Live local test | \n| `403 SERVICE_DISABLED` | Check which service & consumer project lacked enablement ( `--billing-project` vs`--user-project` ) | Live Cloud Billing check | \n| `401` / other`403` | Inspect token expiration, IAM ( `serviceusage.services.use` ), API enablement, and project attribution | Docs diagnostic | \n| `429 RESOURCE_EXHAUSTED` | Distinguish RPM/TPM/RPD, tool caps, and 10-min rolling spend limits; respect server retry backoff | Docs research | \n| `402 Payment Required` | Check Prepay balance / billing account status across the entire linked billing account | Docs research | \n\nBoth issue drafts in `gde-feedback/upstream-issues-draft.md` await submission:\n\n`403` scope/IAM error messages in `gemini-api-cli` (applied upstream in Speakeasy spec/generator rather than patched in generated files).`gemini-cli` consumer migration documentation banners with internal quota tables.\nOfficial references verified during this research: [OAuth quickstart](https://aistudio.google.com/docs/oauth), [ADC troubleshooting](https://docs.cloud.google.com/docs/authentication/troubleshoot-adc), [API CLI](https://aistudio.google.com/docs/cli), [API keys](https://aistudio.google.com/docs/api-key), [Billing](https://aistudio.google.com/docs/billing), [Rate limits](https://aistudio.google.com/docs/rate-limits), [Pricing](https://aistudio.google.com/docs/pricing), [Terms](https://aistudio.google.com/docs/terms), [Interactions](https://aistudio.google.com/docs/interactions-overview), [Agents](https://aistudio.google.com/docs/agents), [Deep Research](https://aistudio.google.com/docs/deep-research), [Video](https://aistudio.google.com/docs/video), [Antigravity plans](https://antigravity.google/docs/plans), [Antigravity install](https://antigravity.google/docs/install/), [Transition announcement](https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/).\n\n`2026-11-15`): ADC Scope Guardrail & §6.5 Cost Proof\nOur `2026-11-15 00:20`–` 00:24` live run confirmed both Part 2 theses in practice:\n\n`$0.00`)`./bin/gapi-adc --agent-mode generate -p gde-jimmyliao-redeem` with `GEMINI_API_KEY` unset deterministically exited `3` (`--reauth`—proving the wrapper fails loudly instead of silently billing the personal pool.`$0.3527 / $0.5485` (~64%)`9:16` keyframes (`gemini-nano-banana-2.1`), dual-speaker TTS (`$0.0021`), and QA (`$0.0109`) combined cost only `~$0.107 USD``$10` rolling 10-minute cap. See `experiments/06-live-execution-and-cost-log/cost-and-call-ledger.md`.", "url": "https://wpnews.pro/news/gemini-api-cli-official-guide-part-2-keyless-adc-oauth-scope-troubleshooting", "canonical_source": "https://dev.to/jimmyliao/gemini-api-cli-official-guide-part-2-keyless-adc-oauth-scope-troubleshooting-user-tier-1nca", "published_at": "2026-11-15 03:15:00+00:00", "updated_at": "2026-11-15 03:21:25.054238+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "large-language-models", "ai-agents"], "entities": ["Google", "Gemini API", "Google Cloud Platform", "Google AI Pro", "Google AI Ultra", "jimmyliao"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/gemini-api-cli-official-guide-part-2-keyless-adc-oauth-scope-troubleshooting", "markdown": "https://wpnews.pro/news/gemini-api-cli-official-guide-part-2-keyless-adc-oauth-scope-troubleshooting.md", "text": "https://wpnews.pro/news/gemini-api-cli-official-guide-part-2-keyless-adc-oauth-scope-troubleshooting.txt", "jsonld": "https://wpnews.pro/news/gemini-api-cli-official-guide-part-2-keyless-adc-oauth-scope-troubleshooting.jsonld"}}