gemini-cli - 💡(How to fix) Fix 403 PERMISSION_DENIED despite Google One AI Pro tier detected in Gemini CLI [1 participants]

What happened?

I am using Gemini CLI v0.39.1 on Windows 11.

I sign in with Google OAuth. The CLI successfully detects my account and tier as Google One AI Pro:

• Auth Method: Signed in with Google
• Tier: Gemini Code Assist in Google One AI Pro
• OS: win32
• CLI Version: 0.39.1

However, every prompt fails with the following error:

403 PERMISSION_DENIED The caller does not have permission

I tested multiple models, including:

• Auto (Gemini 3)
• gemini-2.5-flash

Both fail with the same 403 error.

Full error details from the debug console:

status: 403 statusText: Forbidden message: The caller does not have permission reason: forbidden status: PERMISSION_DENIED responseURL: https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse x-cloudai-companion-trace-id: 91b5641156afb1bd

I have already tried:

• Upgraded Gemini CLI to v0.39.1
• Cleared ~/.gemini and re-authenticated
• Removed the VS Code Gemini Code Assist extension
• Confirmed there are no related environment variables:
  • GOOGLE_CLOUD_PROJECT
  • GOOGLE_CLOUD_PROJECT_ID
  • GEMINI_API_KEY
  • GOOGLE_APPLICATION_CREDENTIALS
  • GOOGLE_GENAI_USE_VERTEXAI
• Switched the model from Auto (Gemini 3) to gemini-2.5-flash
• Set Error Verbosity to Full and checked the debug console

The CLI still detects my Google One AI Pro tier correctly, but the backend rejects all generation requests with 403 PERMISSION_DENIED.

What did you expect to happen?

Since Gemini CLI correctly detects my account as "Gemini Code Assist in Google One AI Pro", I expected prompts to generate responses successfully.

At minimum, gemini-2.5-flash should work without returning 403 PERMISSION_DENIED.

I expected Gemini CLI to allow generation through the Google OAuth / Google One AI Pro route, or to show a more specific entitlement, region, or account eligibility error if my account is not allowed to use this feature.

Client information

Output from /about:

CLI Version: 0.39.1 Git Commit: 4d73f3413 Model: gemini-2.5-flash Sandbox: no sandbox OS: win32 Auth Method: Signed in with Google Tier: Gemini Code Assist in Google One AI Pro

Platform:

Windows 11 PowerShell 7.6.1 Gemini CLI v0.39.1

Note: I removed my email address from this report for privacy, but the CLI shows that I am signed in with a Google account that has Google One AI Pro.

Login information

Login method:

Google OAuth

The CLI shows:

Auth Method: Signed in with Google Tier: Gemini Code Assist in Google One AI Pro

I am not using an API key, Vertex AI, or a Google Cloud project for this test.

I confirmed that the following environment variables are not set:

GOOGLE_CLOUD_PROJECT GOOGLE_CLOUD_PROJECT_ID GEMINI_API_KEY GOOGLE_APPLICATION_CREDENTIALS GOOGLE_GENAI_USE_VERTEXAI

I also cleared the local Gemini CLI auth/config directory and re-authenticated with Google OAuth.

Anything else we need to know?

This looks like a backend entitlement or permission issue.

The CLI correctly identifies my tier as:

Gemini Code Assist in Google One AI Pro

But all generation requests are rejected by:

https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse

with:

403 PERMISSION_DENIED The caller does not have permission

Trace ID:

91b5641156afb1bd

Please check whether my Google One AI Pro account has the correct Gemini CLI / Gemini Code Assist backend entitlement.

I can provide screenshots of:

1. /about showing the Google One AI Pro tier
2. The debug console showing the 403 error and trace ID

<img width="2559" height="1530" alt="Image" src="https://github.com/user-attachments/assets/1507433c-b253-4513-bc93-101052e64a50" /> <img width="1726" height="1044" alt="Image" src="https://github.com/user-attachments/assets/a704a958-7931-45d8-bec7-f38642e6449f" />