hermes - ✅(Solved) Fix [Setup]: [Bug] HTTP 400 API_KEY_INVALID with Google Provider on the latest version (Worked fine in previous version) [1 pull requests, 6 comments, 7 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
NousResearch/hermes-agent#12127Fetched 2026-04-19 15:25:38
View on GitHub
Comments
6
Participants
7
Timeline
24
Reactions
2
Author
Timeline (top)
subscribed ×8commented ×6mentioned ×6cross-referenced ×3

Error Message

I am experiencing a persistent HTTP 400: API_KEY_INVALID error when trying to use the native Gemini provider with Google's OpenAI-compatible endpoint. 📝 Error: HTTP 400: Error code: 400 - [{'error': {'code': 400, 'message': 'API key not valid. Please pass a valid API key.', 'status': 'INVALID_ARGUMENT', 'details': [{'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'API_KEY_INVALID', 'domain': 'googleapis.com', 'metadata': {'service': 'generativelanguage.googleapis.com'}}, {'@type': 'type.googleapis.com/google.rpc.LocalizedMessage', 'locale': 'en-US', 'message': 'API key not valid. Please pass a valid API key.'}]}}] ❌ Non-retryable client error (HTTP 400). Aborting.

Full Error Output

Fix Action

Fixed

PR fix notes

PR #12204: Fix gemini auth header

Description (problem / solution / changelog)

What does this PR do?

When using the Gemini provider, Hermes defaults to Google's OpenAI compatibility endpoint (.../v1beta/openai/). The underlying AsyncOpenAI client handles the Bearer token authorization automatically. However, legacy code was forcefully injecting the native x-goog-api-key header to bypass an old API issue. Sending this native header to the updated /openai compatibility endpoint causes Google's API to throw a 400: API_KEY_INVALID error due to conflicting auth methods.

This PR wraps the legacy header injection in a conditional block, ensuring it is bypassed when connecting to an /openai endpoint, allowing the standard Bearer token to authorize successfully.

Related Issue

Fixes #12168

Type of Change

  • 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✨ New feature (non-breaking change that adds functionality)
  • 🔒 Security fix
  • 📝 Documentation update
  • ✅ Tests (adding or improving test coverage)
  • ♻️ Refactor (no behavior change)
  • 🎯 New skill (bundled or hub)

Changes Made

  • Updated run_agent.py to conditionally apply the x-goog-api-key header hack only if the base_url does not contain /openai.
  • Applied the exact same conditional logic to the three auxiliary client initializations in auxiliary_client.py.
  • Preserved backward compatibility for users explicitly setting legacy non-openai Google endpoints.

How to Test

  1. Set up Hermes with a valid Gemini API key in ~/.hermes/.env (or via config).
  2. Run hermes chat --provider gemini using the default endpoint.
  3. Observe a successful connection and chat response without the HTTP 400 error.

Checklist

Code

  • I've read the Contributing Guide
  • My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
  • I searched for existing PRs to make sure this isn't a duplicate
  • My PR contains only changes related to this fix/feature (no unrelated commits)
  • I've run pytest tests/ -q and all tests pass (Note: Relying on CI pipeline)
  • I've added tests for my changes (required for bug fixes, strongly encouraged for features)
  • I've tested on my platform: Windows

Documentation & Housekeeping

  • I've updated relevant documentation (README, docs/, docstrings) — or N/A
  • I've updated cli-config.yaml.example if I added/changed config keys — or N/A
  • I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
  • I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
  • I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Changed files

  • agent/auxiliary_client.py (modified, +17/-24)
  • run_agent.py (modified, +15/-19)

Code Example



---

Here is the curl output (using the Bearer token authorization):
code
JSON
{"choices":[{"finish_reason":"stop","index":0,"message":{"content":"The user said "hi".\nGreeting.\nRespond politely, welcomingly, and offer assistance.\n\n* "Hello! How can I help you today?"\n* "Hi there! What's on your mind?"\n* "Greetings! How can I assist you?"Hello! How can I help you today?","extra_content":{"google":{"thought":true}},"role":"assistant"}}],"created":1776509595,"id":"m2LjaadQ2Z7aug_34uPJDw","model":"gemma-4-31b-it","object":"chat.completion","usage":{"completion_tokens":9,"prompt_tokens":2,"total_tokens":70}}
To answer your questions:
RAW_BUFFERClick to expand / collapse

What's Going Wrong?

I am experiencing a persistent HTTP 400: API_KEY_INVALID error when trying to use the native Gemini provider with Google's OpenAI-compatible endpoint.

Important Context: * My GEMINI_API_KEY is 100% valid. It works perfectly in OpenClaw and direct curl requests.

It worked perfectly fine this morning. The issue only started happening immediately after I updated to the newest version of Hermes.

I have already completely cleared my WSL environment, deleted ~/.hermes, did a fresh install, and ensured there are no conflicting keys (like AI_GATEWAY_API_KEY) in the .env file. The issue persists.

It seems the latest update introduced a bug in how Hermes formats or passes the API key to the generativelanguage.googleapis.com/v1beta/openai endpoint (possibly an issue with the Bearer token header or URL query construction).

Environment & Setup:

Provider: gemini

Model: gemini-3.1-flash-lite-preview

Endpoint: https://generativelanguage.googleapis.com/v1beta/openai API call failed (attempt 1/3): BadRequestError [HTTP 400] 🔌 Provider: gemini Model: gemini-3.1-flash-lite-preview 🌐 Endpoint: https://generativelanguage.googleapis.com/v1beta/openai 📝 Error: HTTP 400: Error code: 400 - [{'error': {'code': 400, 'message': 'API key not valid. Please pass a valid API key.', 'status': 'INVALID_ARGUMENT', 'details': [{'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'API_KEY_INVALID', 'domain': 'googleapis.com', 'metadata': {'service': 'generativelanguage.googleapis.com'}}, {'@type': 'type.googleapis.com/google.rpc.LocalizedMessage', 'locale': 'en-US', 'message': 'API key not valid. Please pass a valid API key.'}]}}] ❌ Non-retryable client error (HTTP 400). Aborting.

I followed someone‘s instructions and ran the curl test. It worked perfectly and returned a valid response. I tested it with the model gemma-4-31b-it. Here is the curl output (using the Bearer token authorization): code JSON {"choices":[{"finish_reason":"stop","index":0,"message":{"content":"The user said "hi".\nGreeting.\nRespond politely, welcomingly, and offer assistance.\n\n* "Hello! How can I help you today?"\n* "Hi there! What's on your mind?"\n* "Greetings! How can I assist you?"Hello! How can I help you today?","extra_content":{"google":{"thought":true}},"role":"assistant"}}],"created":1776509595,"id":"m2LjaadQ2Z7aug_34uPJDw","model":"gemma-4-31b-it","object":"chat.completion","usage":{"completion_tokens":9,"prompt_tokens":2,"total_tokens":70}} To answer your questions: Model Name: I didn't type the model name manually. The model I used was directly selected from the Hermes installation wizard under the "Google AI Studio" option. Version Before Update: Unfortunately, I don't remember the exact commit hash. It was a version I downloaded about 4-5 days ago. That old version was working perfectly fine this morning. Current Setup: Today, I completely uninstalled that older version and did a fresh install using the installation command, which brought me to the latest version. This is exactly when the API_KEY_INVALID issue started. Other Providers: Other APIs, like Nvidia, are working flawlessly on this newly installed version. Since the curl command works perfectly with the exact same API key and endpoint, and other providers are working fine in Hermes, this heavily points to a regression in how the newest Hermes version handles or passes the API key specifically for the Google AI Studio / Gemini OpenAI-compatible endpoint.

Steps Taken

Here is the curl output (using the Bearer token authorization): code JSON {"choices":[{"finish_reason":"stop","index":0,"message":{"content":"The user said "hi".\nGreeting.\nRespond politely, welcomingly, and offer assistance.\n\n* "Hello! How can I help you today?"\n* "Hi there! What's on your mind?"\n* "Greetings! How can I assist you?"Hello! How can I help you today?","extra_content":{"google":{"thought":true}},"role":"assistant"}}],"created":1776509595,"id":"m2LjaadQ2Z7aug_34uPJDw","model":"gemma-4-31b-it","object":"chat.completion","usage":{"completion_tokens":9,"prompt_tokens":2,"total_tokens":70}} To answer your questions:

Installation Method

Install script (curl | bash)

Operating System

Ubuntu

Python Version

No response

Hermes Version

No response

Debug Report

Full Error Output

Here is the curl output (using the Bearer token authorization):
code
JSON
{"choices":[{"finish_reason":"stop","index":0,"message":{"content":"The user said "hi".\nGreeting.\nRespond politely, welcomingly, and offer assistance.\n\n* "Hello! How can I help you today?"\n* "Hi there! What's on your mind?"\n* "Greetings! How can I assist you?"Hello! How can I help you today?","extra_content":{"google":{"thought":true}},"role":"assistant"}}],"created":1776509595,"id":"m2LjaadQ2Z7aug_34uPJDw","model":"gemma-4-31b-it","object":"chat.completion","usage":{"completion_tokens":9,"prompt_tokens":2,"total_tokens":70}}
To answer your questions:

What I've Already Tried

No response

extent analysis

TL;DR

The most likely fix is to review and adjust how the Hermes version handles API key passing for the Google AI Studio/Gemini OpenAI-compatible endpoint.

Guidance

  • Verify that the API key is correctly formatted and passed in the request headers or query parameters by checking the Hermes code or documentation.
  • Compare the successful curl request with the Hermes request to identify any differences in API key handling.
  • Check the Hermes version's release notes or changelog for any changes related to API key handling or Google AI Studio/Gemini integration.
  • Consider downgrading to a previous version of Hermes that worked correctly with the Google AI Studio/Gemini endpoint.

Example

No code example is provided as the issue is related to the Hermes version and its handling of API keys, which requires more context and information about the Hermes codebase.

Notes

The issue seems to be specific to the latest version of Hermes and its interaction with the Google AI Studio/Gemini OpenAI-compatible endpoint. The fact that other providers work correctly and the curl request is successful suggests a regression in the Hermes version.

Recommendation

Apply a workaround by downgrading to a previous version of Hermes that worked correctly with the Google AI Studio/Gemini endpoint, as the current version seems to have a regression in API key handling.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING