fix: send x-goog-api-key header instead of 'gemini' for Gemini API requests

The GeminiInitializationStrategy was setting key_name='gemini' which was
used as the HTTP header name, sending 'gemini: <key>' instead of the
correct 'x-goog-api-key: <key>' required by the Gemini API. This caused
403 PERMISSION_DENIED errors with message 'Method doesn't allow
unregistered callers'.

Updated strategy, all affected tests, and added a regression test that
verifies the correct header is sent.

Author: Mateusz

src/connectors/strategies/gemini.py

@@ -10,27 +10,27 @@
 class GeminiInitializationStrategy:
     """Initialization strategy for Gemini backend connectors.
 
-    This strategy sets the `key_name` to "gemini" and handles the mapping
+    This strategy sets the `key_name` to "x-goog-api-key" and handles the mapping
     of `api_base_url` to `gemini_api_base_url` for Gemini backend initialization.
     """
 
     def augment_init_config(self, init_config: dict[str, Any]) -> dict[str, Any]:
         """Augment initialization configuration for Gemini backend.
 
-        Sets `key_name = "gemini"` and maps `api_base_url` to `gemini_api_base_url`
+        Sets `key_name = "x-goog-api-key"` and maps `api_base_url` to `gemini_api_base_url`
         if present. If `gemini_api_base_url` is not present after mapping, sets
         the default value.
 
         Args:
             init_config: The base initialization configuration dictionary.
 
         Returns:
-            A new dictionary with `key_name` set to "gemini", `gemini_api_base_url`
+            A new dictionary with `key_name` set to "x-goog-api-key", `gemini_api_base_url`
             mapped from `api_base_url` if present, or set to default if not present,
             and all other values preserved.
         """
         augmented = dict(init_config)
-        augmented["key_name"] = "gemini"
+        augmented["key_name"] = "x-goog-api-key"
 
         # Map api_base_url to gemini_api_base_url for Gemini backend
         if "api_base_url" in augmented:

tests/integration/test_custom_model_parameters.py

@@ -123,7 +123,7 @@ async def test_gemini_top_k_parameter(
         await backend.initialize(
             api_key="test-key",
             gemini_api_base_url="https://generativelanguage.googleapis.com",
-            key_name="gemini",
+            key_name="x-goog-api-key",
         )
         request_data = sample_request_data.model_copy(update={"top_k": 40})
 
@@ -199,7 +199,7 @@ async def test_gemini_reasoning_effort_parameter(
         await backend.initialize(
             api_key="test-key",
             gemini_api_base_url="https://generativelanguage.googleapis.com",
-            key_name="gemini",
+            key_name="x-goog-api-key",
         )
         request_data = sample_request_data.model_copy(
             update={"reasoning_effort": "high"}
@@ -312,7 +312,7 @@ async def test_gemini_top_p_parameter(
         await backend.initialize(
             api_key="test-key",
             gemini_api_base_url="https://generativelanguage.googleapis.com",
-            key_name="gemini",
+            key_name="x-goog-api-key",
         )
         request_data = sample_request_data.model_copy(update={"top_p": 0.6})
 
@@ -338,7 +338,7 @@ async def test_gemini_stop_sequences_parameter(
         await backend.initialize(
             api_key="test-key",
             gemini_api_base_url="https://generativelanguage.googleapis.com",
-            key_name="gemini",
+            key_name="x-goog-api-key",
         )
         request_data = sample_request_data.model_copy(
             update={"stop": ["stop1", "stop2"]}
@@ -388,7 +388,7 @@ async def test_unsupported_parameter_does_not_cause_error(
         await backend.initialize(
             api_key="test-key",
             gemini_api_base_url="https://generativelanguage.googleapis.com",
-            key_name="gemini",
+            key_name="x-goog-api-key",
         )
         request_data = sample_request_data.model_copy(
             update={"unsupported_param": "test"}

tests/integration/test_uri_parameters_e2e.py

@@ -443,7 +443,7 @@ async def test_gemini_with_uri_sampling_parameters(
         backend = backend_factory.create_backend("gemini", mock_app_config)
         await backend.initialize(
             api_key="test-gemini-key",
-            key_name="gemini",
+            key_name="x-goog-api-key",
             gemini_api_base_url="https://generativelanguage.googleapis.com",
         )
 

tests/unit/connectors/strategies/test_gemini.py

@@ -11,14 +11,14 @@
 class TestGeminiInitializationStrategy:
     """Tests for the Gemini initialization strategy."""
 
-    def test_strategy_sets_key_name_to_gemini(self) -> None:
-        """Test that strategy sets key_name to 'gemini'."""
+    def test_strategy_sets_key_name_to_x_goog_api_key(self) -> None:
+        """Test that strategy sets key_name to 'x-goog-api-key'."""
         strategy = GeminiInitializationStrategy()
         config = {"api_key": "test-key", "api_base_url": "https://api.gemini.com"}
 
         result = strategy.augment_init_config(config)
 
-        assert result["key_name"] == "gemini"
+        assert result["key_name"] == "x-goog-api-key"
 
     def test_strategy_preserves_other_config_values(self) -> None:
         """Test that strategy preserves all other configuration values."""
@@ -34,7 +34,7 @@ def test_strategy_preserves_other_config_values(self) -> None:
 
         assert result["api_key"] == "test-key"
         assert result["auth_header_name"] == "x-api-key"
-        assert result["key_name"] == "gemini"
+        assert result["key_name"] == "x-goog-api-key"
 
     def test_strategy_maps_api_base_url_to_gemini_api_base_url(self) -> None:
         """Test that strategy maps api_base_url to gemini_api_base_url when present."""
@@ -83,7 +83,7 @@ def test_strategy_returns_new_dict_does_not_mutate_input(self) -> None:
         assert result is not config
         assert "key_name" not in config
         assert "gemini_api_base_url" not in config
-        assert result["key_name"] == "gemini"
+        assert result["key_name"] == "x-goog-api-key"
         assert result["gemini_api_base_url"] == "https://api.gemini.com"
         # Original BackendFactory behavior preserves api_base_url
         assert result["api_base_url"] == "https://api.gemini.com"
@@ -95,7 +95,7 @@ def test_strategy_overwrites_existing_key_name(self) -> None:
 
         result = strategy.augment_init_config(config)
 
-        assert result["key_name"] == "gemini"
+        assert result["key_name"] == "x-goog-api-key"
         assert result["key_name"] != "other-value"
 
     def test_strategy_handles_empty_config(self) -> None:
@@ -105,7 +105,7 @@ def test_strategy_handles_empty_config(self) -> None:
 
         result = strategy.augment_init_config(config)
 
-        assert result["key_name"] == "gemini"
+        assert result["key_name"] == "x-goog-api-key"
         assert (
             result["gemini_api_base_url"] == "https://generativelanguage.googleapis.com"
         )
@@ -120,7 +120,7 @@ def test_strategy_handles_nested_config_values(self) -> None:
 
         result = strategy.augment_init_config(config)
 
-        assert result["key_name"] == "gemini"
+        assert result["key_name"] == "x-goog-api-key"
         assert result["api_key"] == "test-key"
         assert result["extra"] == config["extra"]
         assert result["extra"]["nested"] == "value"
@@ -139,7 +139,7 @@ def test_strategy_is_registered_with_registry(self) -> None:
         config = {"api_key": "test-key"}
         result = strategy.augment_init_config(config)
 
-        assert result["key_name"] == "gemini"
+        assert result["key_name"] == "x-goog-api-key"
 
     def test_strategy_registry_returns_gemini_strategy(self) -> None:
         """Test that registry returns Gemini strategy for 'gemini' connector type."""
@@ -150,6 +150,6 @@ def test_strategy_registry_returns_gemini_strategy(self) -> None:
         config = {"api_key": "test-key", "some_other_field": "value"}
         result = strategy.augment_init_config(config)
 
-        assert result["key_name"] == "gemini"
+        assert result["key_name"] == "x-goog-api-key"
         assert result["api_key"] == "test-key"
         assert result["some_other_field"] == "value"

tests/unit/connectors/strategies/test_registry.py

@@ -337,7 +337,7 @@ def test_importing_registry_auto_discovers_strategies(self) -> None:
 
         gemini_result = gemini_strategy.augment_init_config(test_config.copy())
         assert "key_name" in gemini_result
-        assert gemini_result["key_name"] == "gemini"
+        assert gemini_result["key_name"] == "x-goog-api-key"
 
         anthropic_result = anthropic_strategy.augment_init_config(test_config.copy())
         assert "key_name" in anthropic_result
@@ -384,7 +384,7 @@ def test_lazy_auto_discovery_works_on_first_access(self) -> None:
         test_config = {"api_key": "test-key"}
         gemini_result = gemini_strategy.augment_init_config(test_config.copy())
         assert "key_name" in gemini_result
-        assert gemini_result["key_name"] == "gemini"
+        assert gemini_result["key_name"] == "x-goog-api-key"
 
         anthropic_strategy = registry.get_strategy("anthropic")
         anthropic_result = anthropic_strategy.augment_init_config(test_config.copy())
@@ -474,7 +474,7 @@ def get_gemini_strategy(thread_id: int) -> None:
                     "key_name" in result
                 ), f"Thread {thread_id} got default strategy instead of gemini strategy"
                 assert (
-                    result["key_name"] == "gemini"
+                    result["key_name"] == "x-goog-api-key"
                 ), f"Thread {thread_id} got wrong strategy: {result.get('key_name')}"
 
                 results.append(result)
@@ -513,11 +513,11 @@ def get_gemini_strategy(thread_id: int) -> None:
             f"Some threads may have timed out or failed."
         )
 
-        # Verify all results are correct (all should have key_name="gemini")
+        # Verify all results are correct (all should have key_name="x-goog-api-key")
         for i, result in enumerate(results):
             assert "key_name" in result, f"Result {i} missing key_name: {result}"
             assert (
-                result["key_name"] == "gemini"
+                result["key_name"] == "x-goog-api-key"
             ), f"Result {i} has wrong key_name: {result.get('key_name')}"
 
         # Verify discovery flag is set

tests/unit/connectors/test_provider_boundary_capture.py

@@ -280,7 +280,7 @@ def handler(request: httpx.Request) -> httpx.Response:
             translation_service=TranslationService(),
         )
         connector.api_key = "test-gemini-key"
-        connector.key_name = "gemini"
+        connector.key_name = "x-goog-api-key"
         connector.gemini_api_base_url = "https://generativelanguage.googleapis.com"
 
         envelope = await connector.chat_completions(

tests/unit/core/test_backend_factory_ensure_backend.py

@@ -280,7 +280,9 @@ async def test_ensure_backend_zai_coding_plan_keeps_explicit_key_over_live_env(
             "src.core.services.backend_factory.get_env_value_with_windows_persistent_fallback",
             return_value=("live-env-key", "process"),
         ),
-        patch.dict(os.environ, {"ZAI_CODING_PLAN_API_KEY": "live-env-key"}, clear=False),
+        patch.dict(
+            os.environ, {"ZAI_CODING_PLAN_API_KEY": "live-env-key"}, clear=False
+        ),
     ):
         result = await factory.ensure_backend(backend_type, app_config, backend_config)
 
@@ -315,7 +317,9 @@ async def test_ensure_backend_zai_coding_plan_keeps_explicit_key_over_windows_pe
             "src.core.services.backend_factory.get_env_value_with_windows_persistent_fallback",
             return_value=("windows-persistent-key", "windows-user"),
         ),
-        patch.dict(os.environ, {"ZAI_CODING_PLAN_API_KEY": "stale-process-key"}, clear=False),
+        patch.dict(
+            os.environ, {"ZAI_CODING_PLAN_API_KEY": "stale-process-key"}, clear=False
+        ),
     ):
         result = await factory.ensure_backend(backend_type, app_config, backend_config)
 
@@ -385,7 +389,9 @@ async def test_ensure_backend_zai_coding_plan_uses_live_env_when_key_missing(
             "src.core.services.backend_factory.get_env_value_with_windows_persistent_fallback",
             return_value=("live-env-key", "process"),
         ),
-        patch.dict(os.environ, {"ZAI_CODING_PLAN_API_KEY": "live-env-key"}, clear=False),
+        patch.dict(
+            os.environ, {"ZAI_CODING_PLAN_API_KEY": "live-env-key"}, clear=False
+        ),
     ):
         result = await factory.ensure_backend(backend_type, app_config, backend_config)
 
@@ -487,7 +493,7 @@ async def test_ensure_backend_gemini_specific(factory: BackendFactory) -> None:
         mock_init.assert_called_once()
         init_config = mock_init.call_args[0][1]
         assert init_config["api_key"] == "gemini-key"
-        assert init_config["key_name"] == "gemini"
+        assert init_config["key_name"] == "x-goog-api-key"
         assert (
             init_config["gemini_api_base_url"]
             == "https://generativelanguage.googleapis.com"

tests/unit/core/test_backend_factory_strategy_regression.py

@@ -134,8 +134,8 @@ async def test_gemini_strategy_is_used_real_registry(
         # Verify Gemini strategy augmentation
         assert init_config["api_key"] == "test-gemini-key"
         assert (
-            init_config["key_name"] == "gemini"
-        ), "Gemini strategy should set key_name='gemini'"
+            init_config["key_name"] == "x-goog-api-key"
+        ), "Gemini strategy should set key_name='x-goog-api-key'"
         assert (
             "gemini_api_base_url" in init_config
         ), "Gemini strategy should set gemini_api_base_url"
@@ -352,9 +352,9 @@ async def test_backward_compatibility_gemini_config_equivalence(
 
         # Verify Gemini strategy preserves existing behavior
         assert init_config["api_key"] == "gemini-api-key"
-        assert init_config["key_name"] == "gemini", (
-            "Gemini strategy should set key_name='gemini' "
-            "(preserving pre-refactoring behavior)"
+        assert init_config["key_name"] == "x-goog-api-key", (
+            "Gemini strategy should set key_name='x-goog-api-key' "
+            "(using correct Gemini API header name)"
         )
         # Verify api_base_url is mapped to gemini_api_base_url
         assert init_config["api_base_url"] == "https://custom-gemini-api.example.com"