gemini-cli - 💡(How to fix) Fix Google One AI Pro OAuth login succeeds, but all Gemini CLI requests fail with 403 PERMISSION_DENIED [1 participants]

Description

I can successfully sign in with Google in Gemini CLI, and the UI shows:

• Signed in with Google
• Plan: Gemini Code Assist in Google One AI Pro

However, any prompt immediately fails with:

• 403 PERMISSION_DENIED
• The caller does not have permission

This happens even after reducing the environment to a minimal OAuth-only setup.

Gemini CLI Version

• gemini-cli 0.38.2

Platform

• macOS
• Apple Silicon / arm64

Date Observed

• April 22, 2026

Reproduction

1. Start with OAuth-only environment variables:

   unset GEMINI_API_KEY
   unset GOOGLE_GEMINI_BASE_URL
   unset GOOGLE_CLOUD_PROJECT
   
   export http_proxy=http://127.0.0.1:7890
   export https_proxy=http://127.0.0.1:7890
   export ftp_proxy=http://127.0.0.1:7890
   export ALL_PROXY=http://127.0.0.1:7890
   export GEMINI_SKILLS_PATH="$HOME/.gemini/skills"

2. Start Gemini CLI:

   gemini

3. Sign in with Google via /auth

4. Send a simple prompt such as:

   hello

   or

   你好

Actual Result

The CLI shows Signed in with Google and recognizes my plan as Gemini Code Assist in Google One AI Pro, but every request fails with:

403 PERMISSION_DENIED
The caller does not have permission

Expected Result

After successful Google OAuth login, prompts should work normally for a Google One AI Pro user.

Debug Output

Running:

env http_proxy=http://127.0.0.1:7890 https_proxy=http://127.0.0.1:7890 gemini -d -p "hello"

shows that the failure happens against cloudcode-pa.googleapis.com, for example:

• https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota
• https://cloudcode-pa.googleapis.com/v1internal:generateContent
• https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse

The first failure already occurs during quota retrieval:

Failed to retrieve user quota _GaxiosError: The caller does not have permission

Important detail: the request body contains an unexpected project value that I did not explicitly configure, e.g.:

{"project":"<unexpected-project-id>"}

So it looks like the OAuth / Code Assist path may be binding me to some backend-selected project, and permission is then denied on that project.

Relevant Log Snippets

Quota retrieval request:

url: 'https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota'
body: '{"project":"<unexpected-project-id>"}'
status: 403
message: 'The caller does not have permission'

Content generation request:

url: 'https://cloudcode-pa.googleapis.com/v1internal:generateContent'
status: 403
message: 'The caller does not have permission'

Streaming request:

url: 'https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse'
status: 403
message: 'The caller does not have permission'

Trace IDs

Observed trace IDs:

• 3c3a18e3b3d1f326
• 2f771f5e304a03f3
• c93a86b7b277c14a
• 4eec5903059b82f3
• c665a11bf123a86b

Notes

• This is not an API key flow. The CLI clearly shows Signed in with Google.
• The issue persists even with GOOGLE_CLOUD_PROJECT unset.
• The proxy is working correctly, since requests do reach Google backend services.
• keytar falls back to file storage on my machine, but that does not appear to be the root cause, because OAuth credentials are loaded and requests are sent successfully before the backend returns 403.

Question

Is this a known entitlement / backend project-binding issue for Gemini Code Assist in Google One AI Pro accounts?

If needed, I can also provide redacted CLI-generated JSON error reports on request.