Gemini API Errors in n8n: 403 "unregistered callers", 400 "API key not valid", 401 "Expected OAuth 2 access token"

Gemini API returns 403 unregistered callers, 400 API key not valid or 401 Expected OAuth 2 access token? What each one meant when I tested it, and a checklist.

When a call to the Gemini API from n8n fails with 403, 400 or 401 and the message talks about keys or credentials, the three codes point to three different mistakes. I sent the same request to the API in four different ways and recorded what came back, so you can tell which mistake you made from the message alone.

The three errors at a glance

HTTP	Status and reason	Message	What it meant in my test
403	`PERMISSION_DENIED`	Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.	No key reached the API at all
400	`INVALID_ARGUMENT`, reason `API_KEY_INVALID`	API key not valid. Please pass a valid API key.	A key was sent, and the API did not accept it
401	`UNAUTHENTICATED`, reason `CREDENTIALS_MISSING`	Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential.	The key was sent as a Bearer token, and the API looked for an OAuth token

What I tested

On 2026-10-21 I sent a read-only GET request to https://generativelanguage.googleapis.com/v1beta/models (the model list) with curl. I used a made-up key, never a real one.

How the key was sent	Result
No key	403, `PERMISSION_DENIED`
Made-up key as the `key` query parameter	400, `API_KEY_INVALID`
Made-up key in the `x-goog-api-key` header	400, `API_KEY_INVALID` (same response)
Made-up key in an `Authorization: Bearer` header	401, `CREDENTIALS_MISSING`

The query-parameter and header versions returned the same error, so the API read a key from both places. The test cannot tell you whether a valid key works in both places, because I did not have to send one.
Only the Bearer version produced the confusing "Expected OAuth 2 access token" message. If you see it, the likely mistake is the authentication type, not the key itself.

How to send the key

The official Gemini API key documentation shows the key sent in a request header called x-goog-api-key. In n8n, my HTTP Request nodes use Generic Credential Type with Header Auth, a header named x-goog-api-key, and the key as the value. I also used n8n's predefined Google Gemini (PaLM) Api credential type for another Gemini call, and it returned a normal response.

To test a key outside n8n, this request lists the available models.

curl -H "x-goog-api-key: YOUR_API_KEY" \
https://generativelanguage.googleapis.com/v1beta/models

I did not run that command with a real key, so I cannot show you the expected output.

A short checklist

403 "unregistered callers": no key arrived. In the node, check that an authentication type is actually selected and that a credential is attached. This is what my test looked like when I sent nothing.
400 "API key not valid": a key arrived but is not accepted. Common causes are a typo, extra spaces, a deleted key or a key from another project. I only tested a made-up key, so these causes are possibilities, not results.
401 "Expected OAuth 2 access token": the key was sent as a Bearer token. Switch to the x-goog-api-key header, or use n8n's Gemini credential type.

Related errors I have written up: the 400 for a wrong model name format and a reply cut off mid-sentence.

Keep the key out of your files

The documentation says to treat the key like a password and not to check it into source control. In n8n I keep it in the credential and never in the workflow JSON.

What I did not test

I did not test a real, valid key, so I cannot confirm which sending methods work for a valid one beyond what the documentation shows.
I used the model list request, not generateContent. Errors for other endpoints may differ.
I did not look at how n8n displays these errors, because I used curl for the tests.
I did not test restricted keys, other Google sign-in methods or rate limit errors.

Source: Gemini API documentation, using Gemini API keys. The error messages come from my own requests on 2026-10-21.