#Google cli error

1 messages · Page 1 of 1 (latest)

elder light
#

• Cloud Code Assist API error (403): cloudaicompanion.companions.generateChat denied

craggy raptorBOT
#

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> âś… Mark Solution

vital canyonBOT
#

That 403 is coming from Gemini for Google Cloud (a.k.a. Cloud AI Companion) and it basically means:

the identity you’re authenticated as does not have the IAM permission cloudaicompanion.companions.generateChat on the GCP project shown in the error (.../projects/<PROJECT_ID>/locations/global).

What to check / fix

  1. Make sure you’re using the right project
  1. Enable the API in that project
    Enable Gemini for Google Cloud API (cloudaicompanion.googleapis.com) on the same project:
#
  1. Grant the right IAM role
    Grant one of the roles that includes cloudaicompanion.companions.generateChat (common ones):
  1. If this is “Code Assist Standard/Enterprise”: license/subscription
    If you’re using the paid org product, you also need the subscription + user license assignment, otherwise you’ll keep getting blocked in various ways:
    https://docs.cloud.google.com/gemini/docs/codeassist/set-up-gemini
#

If you paste (a) the exact projects/<...> from the error and (b) whether you’re in Cloud Shell vs local + which auth mode you used (Gemini CLI “login with Google” vs “use a GCP project”), I can tell you which of the above is the likely missing piece.

elder light
#

So basically, i can use gemini cli in chat through google/, but when I try to use gog and calls cron, it gives me No API key found for provider "google". So when I rename it to google-gemini-cli, it gives me 404 error. And project id and IAM is already set

vital canyonBOT
#

google vs google-gemini-cli are different providers in OpenClaw, with totally different auth:

So if cron says “No API key found for provider google”, that cron/job (or the gog agent) is still configured to use google/..., and the gateway process running cron can’t see GEMINI_API_KEY (common when the gateway runs as a service and your shell env isn’t loaded).

Fix paths (pick one)

A) You want google/... (API key)

B) You want Gemini CLI OAuth (no API key)

#

Don’t “rename” providers manually—use the official plugin flow:

From the FAQ:

Quick triage questions (so we can pinpoint it)

  1. What’s your openclaw --version?
  2. What model is the working chat using vs what model the cron / gog agent is using? (provider/model string)
  3. Can you paste openclaw models status? (it will show whether the gateway sees the key / profiles)

With those 3, we can tell if it’s (1) wrong provider selected for cron, or (2) env not reaching the gateway service, or (3) plugin not enabled/logged-in on the gateway host.

elder light
#
  1. Latest version
  2. So basically, if I just use gemini cli model, it gives me cloud code assist 403, however, if I just rename them to google/ (I’m using oauth method) it works fine. There’s no problem at all, and idk why but it works. So I understand it will give api key not found when I call cron, but it works fine in chat, like reply, does things and more. However my Gemini cli model just returns cloud code asssit 403 error… I need help with this shit
vital canyonBOT
#

What you’re seeing is basically two different backends that just happen to both be “Gemini-ish”, but they auth completely differently:

1) Why google-gemini-cli is throwing Cloud Code Assist 403

The Gemini CLI provider (google-gemini-cli) routes through Google’s Cloud Code Assist / AI Companion API (cloudaicompanion.googleapis.com). That’s exactly why the permission in the error is:

  • cloudaicompanion.companions.generateChat

A 403 there almost always means your current identity + current GCP project does not have Gemini Code Assist / Gemini for Google Cloud access (IAM role and sometimes org entitlement/license), or the CLI is using the wrong project.

Gemini CLI requires you to explicitly set the GCP project it should use:
https://geminicli.com/docs/get-started/authentication#set-your-google-cloud-project

If the error mentions some weird project you don’t recognize (common examples are cloudshell-gca / hazel-proxy-...), that’s a huge hint the CLI isn’t using your project at all.

2) Why “renaming to google/...” appears to work (but then cron complains)

In OpenClaw, provider google is Gemini HTTP API (API key), not OAuth. It expects GEMINI_API_KEY (with GOOGLE_API_KEY as a fallback env var). Docs:
https://docs.openclaw.ai/concepts/model-providers#google-gemini-api-key

#

So if google/... “works in chat” but cron says “No API key found for provider google”, one of these is true:

  • the gateway service that runs cron can’t see your env vars (super common when running as a daemon/service), or
  • you’re not actually using provider google in the way you think (model routing/fallback/agent differences)

FAQ for the “service env differs from terminal env” problem:
https://docs.openclaw.ai/help/faq#i-started-the-gateway-via-the-service-and-my-env-vars-disappeared-what-now

The fastest way to unblock you

Pick what you actually want:

Option A — You want Gemini CLI OAuth

Then you need to make Gemini CLI itself happy:

  1. Ensure you’ve enabled + logged into the plugin on the gateway host:
    • openclaw plugins enable google-gemini-cli-auth
    • openclaw models auth login --provider google-gemini-cli --set-default
  2. Make sure the CLI is pointed at a GCP project where your account has access (link above), and that Gemini for Google Cloud / Code Assist is enabled/allowed in that project/org.
#

If you don’t have Code Assist entitlements for that org/project, google-gemini-cli will keep 403’ing forever — that’s Google-side.

Option B — You just want it to work for cron + chat

Use either:

  • google-antigravity/... (OAuth plugin), or
  • google/... with a real GEMINI_API_KEY available to the gateway service

Don’t “rename” providers manually; the model ids + auth expectations differ and you’ll get 404/403 in weird combos.

One paste that will let me tell you exactly which case you’re in

Can you paste the output of:

  • openclaw models status

…and the exact project string from the 403 (the projects/<...> part).

That will immediately show whether you’re missing (a) plugin auth, (b) project selection, or (c) Code Assist entitlement/IAM.

elder light
#

Is antigravity available in current version. ???

vital canyonBOT
#

Yes — Google Antigravity OAuth is available in current OpenClaw, but it’s shipped as a bundled plugin and is disabled by default.

Per the docs (Model providers + Plugins):

  • Enable the plugin:
openclaw plugins enable google-antigravity-auth
  • Then login + set it as default auth profile:
openclaw models auth login --provider google-antigravity --set-default

Docs:

#

After enabling a bundled plugin, you typically need a gateway restart for it to load:

openclaw gateway restart

If you run openclaw plugins list, you should see google-antigravity-auth in the list (enabled/disabled state).

elder light
#

Are you sure

vital canyonBOT
#

Yep.

OpenClaw docs explicitly list Google Antigravity OAuth as a bundled plugin:

If you want to double-check on your install, run:

openclaw plugins list
openclaw plugins info google-antigravity-auth