How to connect Gemini API to Replit: secure setup

Summary: how to connect Gemini API to Replit

Create or copy a key in Google AI Studio. In Replit, open Secrets and add an app secret named `GEMINI_API_KEY`. Install `@google/genai` for JavaScript or `google-genai` for Python. Initialize the SDK on the server and send a small request through the current Interactions API.

Do not place the key in source files, public environment variables, frontend bundles, local storage, or screenshots. Route browser requests through your own server endpoint. Add production Secrets in the Publishing pane and test the public URL after deployment.

Use a six-stage connection flow. Generate the key, save the secret, install the SDK, call from the server, test Preview, and verify deployment.

Choose managed AI or a direct Gemini key

Replit offers a managed AI Integrations route that can provision credentials and charge model usage through Replit. A direct Gemini API connection uses your Google AI Studio project, key, quotas, billing, model access, and usage records.

• Choose Replit AI Integrations when you want Agent to connect a supported model with platform-managed credentials and Replit billing.
• Choose a direct Gemini key when you need Google's SDK, project controls, API features, quotas, or billing relationship.
• Use one route for each request path so ownership, cost, and failure handling remain clear.
• Confirm current model availability and plan limits before choosing a route for production.

Replit's AI Integrations overview describes its managed model connection, credential provisioning, usage display, and billing approach.

Create a Gemini API key in Google AI Studio

A Gemini API key belongs to a Google Cloud project. New AI Studio users may receive a default project and key after accepting the terms. Existing Google Cloud users may need to import a project before creating a key.

1. 1Open the API Keys page in Google AI Studio and choose the Google Cloud project that should own usage and billing.
2. 2Generate a new API key or copy an existing key that is restricted for Gemini API use.
3. 3Record which environment owns the key, such as development, staging, or production.
4. 4Review the project's usage, billing, member access, and key restrictions before sharing the Replit app.
5. 5Plan a rotation path so a replacement key can be deployed and tested before the old key is revoked.

Google's API key guide explains AI Studio projects, current key types, environment variables, restrictions, rotation, and migration guidance.

Store the key as a Replit Secret

Replit Secrets encrypts sensitive values and exposes them to the app as environment variables. Use an app-level secret for one project. Use an account-level secret only when several projects need the same credential and its access has been reviewed.

1. 1Open the Replit project and select All tools from the left tool dock.
2. 2Open Secrets, remain on the App Secrets tab, and select New Secret.
3. 3Set Key to `GEMINI_API_KEY` and paste the Google key into Value.
4. 4Select Add Secret, then restart the running process if it does not read the new environment variable.
5. 5Check only whether the variable exists. Avoid printing its value into the console or logs.

Replit's Secrets documentation explains encrypted app and account secrets, environment variable access, collaborator visibility, and deployment support.

Connect with JavaScript and the current SDK

Google's current JavaScript package is `@google/genai`. The client detects `GEMINI_API_KEY` from the environment, so the application does not need to pass the secret through source code.

1. 1Open Replit Shell and run `npm install @google/genai`.
2. 2In a server-only module, import `GoogleGenAI` from `@google/genai`.
3. 3Initialize the client with `const ai = new GoogleGenAI({});`.
4. 4Send a small text input through the Interactions API with a current model.
5. 5Return only the required output to your browser client.

Minimal server-side request: `const interaction = await ai.interactions.create({ model: "gemini-3.6-flash", input: "Reply with one short test sentence." }); console.log(interaction.output_text);`

Connect with Python

Google's current Python package is `google-genai`. It also detects the environment key when you create the client without embedding credentials.

1. 1Open Replit Shell and run `pip install -U google-genai`.
2. 2Import the SDK with `from google import genai`.
3. 3Build the client with `client = genai.Client()` in server-side code.
4. 4Send a bounded input through the Interactions API with a current model.
5. 5Return a validated output from your server route.

Minimal request: `interaction = client.interactions.create(model="gemini-3.6-flash", input="Reply with one short test sentence.")` followed by `print(interaction.output_text)`.

Google's current Gemini quickstart recommends the Interactions API and provides JavaScript, Python, and REST examples with the latest SDK patterns.

Keep Gemini calls on the server

A Replit Secret protects the key only while the value stays on the server. Browser code is delivered to users and can expose embedded values or responses that contain sensitive data.

• Add a server route that accepts the smallest input needed for the Gemini task.
• Authenticate the caller when the route is private, personalized, expensive, or connected to user data.
• Validate input type, length, file size, and allowed operations before sending a model request.
• Set request timeouts and output limits that fit the product experience and cost boundary.
• Return a controlled error message to the browser while logging a safe diagnostic on the server.
• Remove secrets, personal data, and unnecessary prompt content from application logs.

Test one request in Replit Preview

Start with a small server-only test before building a chat interface. This isolates key, SDK, model, network, and response problems from frontend state and styling.

1. 1Check that `GEMINI_API_KEY` exists without printing its value.
2. 2Run a one-sentence input from the server and confirm that output text is returned.
3. 3Open Preview and call your server route through the same path the browser will use.
4. 4Test missing input, oversized input, invalid authentication, and upstream API failure.
5. 5Inspect server logs for status codes and request identifiers without logging the key or full private prompt.
6. 6Add a small automated test around input validation and the application response shape.

Configure production before publishing

A project that works in Preview can still fail after publishing. Replit's current troubleshooting guide says Project Editor Secrets do not automatically carry into the published app. Add the production value in the Publishing pane.

1. 1Add `GEMINI_API_KEY` to production Secrets and environment variables in the Publishing pane.
2. 2Confirm the deployed server uses the correct build command, start command, host, port, and backend deployment type.
3. 3Publish, open the public URL, and send the same small request used in Preview.
4. 4Compare Preview and production logs when only the public app fails.
5. 5Review Google AI Studio usage to confirm that the expected project receives the request.
6. 6Set budget and usage monitoring before real traffic reaches the endpoint.

Replit's publishing troubleshooting guide covers Preview checks, production Secrets, logs, commands, ports, health checks, and public URL failures.

Troubleshoot connection errors in order

Missing key

confirm the exact `GEMINI_API_KEY` name in the active Replit environment and restart the process.

Authentication error

verify the key, its Google project, restrictions, status, and current key type in AI Studio.

Package error

check that `@google/genai` or `google-genai` is installed in the environment that runs the server.

Model error

use a model listed in the current Gemini documentation and available to the key's project and region.

Rate limit response

inspect the API error, reduce unnecessary requests, apply bounded backoff, and review current project limits.

Billing response

confirm the intended Google Cloud project and paid-tier setup when the requested usage needs it.

Preview succeeds but production fails

check production Secrets, deployment logs, server start behavior, and network settings.

Browser reveals the key

rotate the key, remove it from client code, deploy the replacement, and audit usage.

Google's rate limits guide explains how limits apply by project and how current usage tiers affect requests.

Use a production readiness checklist

• Separate development and production keys when the team needs independent access, quotas, rotation, or incident response.
• Give the server route authentication, authorization, validation, rate limiting, timeouts, and safe error handling.
• Track request count, latency, failures, model, environment, and cost signals without storing sensitive prompts by default.
• Test the exact model behavior your product depends on instead of treating a successful API call as product validation.
• Document who owns the Google project, Replit app, production Secret, billing alerts, key rotation, and incident response.
• Recheck current SDK, model, key, quota, and deployment guidance before a major release.

Read the Better Design Replit models guide to understand model ownership and selection before connecting a provider API.

Frequently asked questions