Google BYOK 401 with new AI Studio AQ. auth keys (direct Gemini API works)

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cursor IDE — Google BYOK (Settings → Models → Google API Key) in Agent chat.

Describe the Bug

A valid Google AI Studio Auth key (AQ. prefix, not the old AIza… format) works against Google’s native Gemini API, but Cursor Google BYOK returns:

Unauthorized User API key / ERROR_BAD_USER_API_KEY

This is not the known “OpenAI key applied to all providers” bug. OpenAI BYOK was turned off and the OpenAI Base URL is unset.

Steps to Reproduce

  1. Create a new API key in Google AI Studio. New keys are issued as Auth keys starting with AQ.
  2. Confirm the key works outside Cursor against generativelanguage.googleapis.com (list models + generateContent both 200).
  3. Cursor Settings → Models: enable only the Google API key. OpenAI key toggle off. OpenAI Base URL reset/empty. Restart Cursor.
  4. New Agent chat, select Gemini 3.8 Flash (also tried High / reasoning_effort=high).
  5. Send a simple message like hi.

Expected Behavior

Cursor should send the AQ. Auth key the same way the native Gemini API expects (x-goog-api-key / ?key= to generativelanguage.googleapis.com) and the request should succeed.

Actual Behavior

Cursor backend returns 401 almost immediately (~1.6s). Direct Google calls with the same key still succeed.

Request IDs:

  • 16797fa9-f7bc-40d7-903e-c5eb3487af9f
  • e2548575-1a8f-41a0-8e62-38351a74b50d (fresh chat, prompt hi, model gemini-3.8-flash-high)

Related local config at the time of the second request:

  • useGoogleKey = true
  • useOpenAIKey = false
  • openAIBaseUrl = null

Google is migrating AI Studio keys from Standard (AIza) to Auth (AQ.). Several other tools fail these keys with 401 ACCESS_TOKEN_TYPE_UNSUPPORTED unless they pass x-goog-api-key. Cursor’s client does not call generativelanguage.googleapis.com directly (no x-goog-api-key in the workbench bundle), so this likely needs a backend change.

I am not posting the key. Happy to share more Request IDs.

Operating System

macOS 15/26 (darwin 25.5.0)

Version Information

Cursor 3.18.25

Does this stop you from using Cursor

No — Cursor works with built-in models. Google BYOK with new AI Studio Auth keys does not.

2

Hi there!

We detected that this may be a bug report, so we’ve moved your post to the Bug Reports category.

To help us investigate and fix this faster, could you edit your original post to include the details from the template below?

Bug Report Template - Click to expand

Where does the bug appear (feature/product)?

  • Editor, Tab & Chat (autocomplete, Composer, in-editor agent)
  • Terminal & commands
  • Models, pricing & API keys (availability, Auto/Max, BYOK/Bedrock)
  • MCP & tools
  • Cloud Agents & Automations (cursor.com/agents, scheduled/event)
  • BugBot & Code Review
  • Cursor CLI
  • Cursor Mobile
  • Remote (SSH / Dev Containers / WSL)
  • Account, billing & login
  • Something else…

Describe the Bug
A clear and concise description of what the bug is.

Steps to Reproduce
How can you reproduce this bug? We have a much better chance at fixing issues if we can reproduce them!

  1. …
  2. …
  3. …

Expected Behavior
What is meant to happen here that isn’t working correctly?

Screenshots / Screen Recordings
If applicable, attach images or videos (.jpg, .png, .gif, .mp4, .mov)

Operating System

  • Windows 10/11
  • MacOS
  • Linux

Version Information

  • For Cursor IDE: Menu → About Cursor → Copy
  • For Cursor CLI: Run agent about in your terminal
IDE:
Version: 2.xx.x
VSCode Version: 1.105.1
Commit: ......

CLI:
CLI Version 2026.01.17-d239e66

For AI issues: which model did you use?
Model name (e.g., Sonnet 4, Tab…)

For AI issues: add Request ID with privacy disabled
Request ID: f9a7046a-279b-47e5-ab48-6e8dc12daba1
For Background Agent issues, also post the ID: bc-…

Additional Information
Add any other context about the problem here.

Does this stop you from using Cursor?

  • Yes - Cursor is unusable
  • Sometimes - I can sometimes use Cursor
  • No - Cursor works, but with this issue

The more details you provide, the easier it is for us to reproduce and fix the issue. Thanks!

6

Hey, thanks for the detailed report and for quickly ruling out any overlap with an OpenAI key.

Good news: the AQ. key format isn’t the issue, your key is fine. What you’re seeing is specific to Gemini 3.8 Flash when your own Google API key is enabled. Requests to that one model with your key are currently getting rejected with 401. Other Gemini models work fine with the same key.

We’re tracking this. I can’t share an exact timeline yet, but I’ll post an update in the thread as soon as we have one.

For now, here are two options that should work:

  1. Keep Google API key enabled and pick a different Gemini model in the model selector, like Gemini 3.7 Flash. It should work with your key as expected, and others have confirmed this in the neighboring thread: BYOK Gemini Flash 3.8 Unauthorized User API key
  2. If you specifically need Gemini 3.8 Flash, turn off the Google API Key toggle in Cursor Settings > Models, and the model will run on your Cursor plan.

If you try option 1 and confirm whether Gemini 3.7 Flash works with your AQ. key, that will fully close the question about the key format. Let me know how it goes.

8

Hi dean, Any news regarding the issue?

11

No status update yet. As soon as I have one, I’ll reply in this thread.

In the meantime, the options are the same:

  1. Keep Google API Key enabled and pick a different Gemini model in the model selector, like Gemini 3.7 Flash. With your key it works as usual. This was confirmed in another thread: BYOK Gemini Flash 3.8 Unauthorized User API key
  2. If you specifically need Gemini 3.8 Flash, turn off the Google API Key toggle in Cursor Settings > Models, and the model will run on your Cursor plan.

Let me know if any of this doesn’t work.

12

Any ETA on the fix?

Gemini 3.8 seems to be significantly better than 3.7 and I would like to bill it to my GCP account

13

Hi, any updates on this one? It seems like a relatively minor issue to fix, but it’s been quite frustrating to see BYOK-related issues consistently pushed down the priority list. I understand that BYOK may not be a major business priority for Cursor, but it’s an important feature for users who rely on it, so I’d really appreciate a quick fix if possible. Thanks!

14

No status update yet. As soon as there is one, I’ll post it right here.

@Jayesh_Singh, honestly, there’s currently no way to run Gemini 3.8 Flash using your own Google key. That’s exactly the issue we’re tracking. For now, you’ve got two options:

  1. Keep Google API Key enabled and pick a different Gemini model, for example Gemini 3.7 Flash. It works fine with your AQ. key. Confirmed in this thread: BYOK Gemini Flash 3.8 Unauthorized User API key
  2. If you specifically need 3.8 Flash, turn off the Google API Key toggle in Cursor Settings > Models. Then the model will run on your Cursor plan.

@valieff, got your point about BYOK. I’ve shared with the team that this is an important use case for you. I can’t give an ETA, but it’s on our radar, and I’ll update the thread as soon as I have anything to share.