Issue Station
Sign In
Tools hereToolbox

gemini-cli - 💡(How to fix) Fix Google sign-in returns 403 PERMISSION_DENIED from cloudcode-pa in Gemini CLI [2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
google-gemini/gemini-cli#26036•Fetched 2026-04-28 06:50:07
View on GitHub
Comments
2
Participants
3
Timeline
3
Reactions
0
Author
runweanrunwean
Participants
HubooooHuboooorunweanrunweanZhaochenghaoZhaochenghao
Timeline (top)
commented ×2labeled ×1

Error Message

Error: "error": { Endpoint observed in error: cloudcode-pa.googleapis.com/v1internal:streamGenerateContent

Code Example

{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}
RAW_BUFFERClick to expand / collapse

What happened?

I am unable to use Gemini CLI with Google sign-in.

I am not using an AI Studio API key. I signed in with my personal Google account, which has a paid Gemini/Google AI subscription, but every prompt fails with a 403 PERMISSION_DENIED response from the Code Assist backend.

Details:

  • CLI Version: 0.39.1
  • Auth Method: Signed in with Google
  • Account type: Personal Google account, not Workspace
  • Subscription: Paid Gemini/Google AI subscription
  • Tier shown by CLI: Gemini Code Assist for individuals
  • Model: gemini-2.5-flash
  • Endpoint: cloudcode-pa.googleapis.com/v1internal:streamGenerateContent
  • Status: 403 PERMISSION_DENIED
  • x-cloudaicompanion-trace-id: bd3479516a3ed9e

Error:

{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}

This looks like the Gemini Code Assist backend is rejecting my signed-in account, even though authentication succeeds.

What did you expect to happen?

After signing in with my personal Google account, Gemini CLI should be able to send prompts and receive responses from gemini-2.5-flash without returning 403 PERMISSION_DENIED.

Client information

Platform: macOS Gemini CLI Version: 0.39.1 Auth type: Login with Google / OAuth Tier: Gemini Code Assist for individuals Model: gemini-2.5-flash Account: personal Google account, email redacted Endpoint observed in error: cloudcode-pa.googleapis.com/v1internal:streamGenerateContent Trace ID: bd3479516a3ed9e

Login information

I am logging in with "Sign in with Google" / OAuth using a personal Google account.

I am not using an AI Studio API key and I am not using Vertex AI. I have unset API-key and Vertex-related environment variables before retrying:

  • GEMINI_API_KEY unset
  • GOOGLE_API_KEY unset
  • GOOGLE_GENAI_USE_VERTEXAI unset
  • GOOGLE_CLOUD_PROJECT unset
  • GOOGLE_CLOUD_LOCATION unset

The account has a paid Gemini/Google AI subscription, and the CLI shows "Gemini Code Assist for individuals", but requests still fail with 403 PERMISSION_DENIED.

Anything else we need to know?

No response

extent analysis

TL;DR

The most likely fix is to verify the subscription and permissions associated with the personal Google account used for signing in, as the 403 PERMISSION_DENIED error suggests a permission issue despite successful authentication.

Guidance

  • Check the Google account's subscription status and ensure it's correctly linked to the Gemini/Google AI service.
  • Verify that the account has the necessary permissions to access the Gemini Code Assist backend, potentially involving checking the account's roles or access control settings.
  • Review the environment variables to ensure no conflicting settings are overriding the intended authentication method, even though the user has unset specific variables.
  • Consider testing with a different account or subscription tier to isolate if the issue is account-specific or related to the subscription type.

Notes

The issue seems to be related to permissions rather than authentication, given the successful sign-in but failed requests. The fact that the account has a paid subscription and the CLI recognizes it suggests a potential misconfiguration or oversight in permission settings.

Recommendation

Apply workaround: Verify account permissions and subscription settings, as the issue appears to be related to access control rather than the authentication process itself. This approach is recommended because it directly addresses the error message indicating a permission denial.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#environment variable#API middleware#SSR setup#ISR setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING