Google AI Studio vs the Gemini App vs the Gemini API: Get a Key and Make Your First Request

Gemini, Google AI Studio and the Gemini API are three different things. Gemini is the chat app. Google AI Studio is the developer website where you try prompts and create an API key. The Gemini API is what your own code calls once you have that key. Knowing which one you need saves an afternoon.

The three things, side by side#

They share the same models underneath. You test a prompt in AI Studio, then reproduce it in code through the API.

A useful way to think about it: the app is a finished product, AI Studio is a workbench, and the API is the pipe your software talks through.

Step 1: get an API key#

1. Open Google AI Studio and sign in with a Google account.
2. Go to the API keys section and create a key.
3. Copy it once and store it somewhere private.

The key is linked to a Google Cloud project. Treat it exactly like a password: anyone with it can use your quota, and on a paid tier, your money.

If a key is ever pasted into a chat, a screenshot, a public repository or a client-side file, assume it is exposed. Delete it in the API keys section, create a new one and update your environment variable.

Step 2: keep the key on the server#

This is the mistake that costs people the most. If you put the key in front-end code, for example in a variable that is bundled into the browser, every visitor can read it.

In Next.js, for instance, a variable whose name starts with NEXT_PUBLIC_ is inlined into the browser bundle. Do not name your key that way. Use a plain name such as GEMINI_API_KEY, read it only in server code (a route handler or a server action), and call the API from there.

Two habits protect you further. Keep your .env.local file out of version control by listing it in .gitignore, and use a different key for local experiments than for anything a customer uses, so you can delete one without breaking the other.

Step 3: your first request#

Google's API also offers an OpenAI-compatible endpoint, which is handy if you already have code written for that format. The request below is the pattern I use in a private tool of mine to check how a model responds and whether it returns valid JSON.

// Run with: node --env-file=.env.local first-request.mjs
const res = await fetch(
  'https://generativelanguage.googleapis.com/v1beta/openai/chat/completions',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.GEMINI_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      model: 'YOUR_MODEL_NAME', // copy a current name from AI Studio
      temperature: 0,
      response_format: { type: 'json_object' },
      messages: [
        { role: 'system', content: 'Reply with a single JSON object only.' },
        { role: 'user', content: 'Extract skills from: "Engineer. Python, SQL, Docker."' },
      ],
    }),
  }
);
 
const data = await res.json();
console.log(res.status, data.choices?.[0]?.message?.content);

Two notes:

• Model names change. Copy a current one from AI Studio rather than from an article, including this one.
• Always check the status. A 200 means success; anything else, read the body.

What a good result looks like#

If everything is set up, the script prints 200 followed by the model's reply. Because the prompt asks for a single JSON object, the reply should be text you can pass to JSON.parse. If it prints something else, do not assume the model is broken. Work through the checks in the next section.

Where to put this in a real app#

Once the script works, move the same call into a route handler or serverless function. Your front end sends the user's input to your own endpoint, your endpoint adds the key and calls the API, and only the result goes back to the browser. Validate and limit what users can send, so a stranger cannot use your key as a free AI service.

What to check first when it fails#

Most first-request failures come from a small set of causes. Work through them in this order.

1. Read the status code and the body. Print both. The body usually contains an error message that names the problem, which is faster than guessing.
2. Is the key being read at all? If process.env.GEMINI_API_KEY is empty, the header becomes Bearer undefined. Run the script with the --env-file flag shown above, check the file name and make sure there are no quotes or spaces around the value.
3. Is the model name valid? A typo or an outdated name is a common reason for a not-found style error. Copy a current name from AI Studio.
4. Does the URL match the format you are using? The code above uses an OpenAI-compatible path. If you switch to Google's own request format, the URL and the body shape are different, so follow Google's current documentation for that format.
5. Is the body valid JSON? A stray comma or a missing quote gives a bad-request response. Build the body with JSON.stringify, as above, instead of writing the string by hand.
6. Did you hit a limit? A 429 means a rate limit, covered in the next step.

What common status codes usually mean#

These are general HTTP meanings. The exact message and cause for your request will be in the response body.

If the model returns text that is not valid JSON even though you asked for it, log the raw string. Sometimes the reply is wrapped in extra text or cut short, and parsing inside a try and catch block lets your program fail gracefully instead of crashing.

Step 4: handle limits#

Free and paid tiers both have limits on requests per minute and per day. Go over, and the API returns HTTP 429.

A simple pattern:

1. On a 429, wait a moment and retry.
2. Cap how many retries you allow.
3. Cache answers you already paid for or waited for.

Here is a small retry helper you can wrap around the request. It waits a little longer each time and stops after a few attempts.

async function withRetry(makeRequest, maxAttempts = 3) {
  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
    const res = await makeRequest();
    if (res.status !== 429 && res.status < 500) return res;
    if (attempt === maxAttempts) return res;
    await new Promise((r) => setTimeout(r, attempt * 2000));
  }
}

Which models are free and what the limits are changes often, and third-party guides disagree with each other. Check the official Gemini API rate limits page and your own project's limits inside AI Studio before you plan around any figure.

How to check what you are using#

Rather than trusting a number from an article, confirm things in the places that stay current.

• Model name: open AI Studio and copy the name shown for the model you chose.
• Limits: read the rate limits page in Google's documentation and the usage information for your own project.
• Cost: check the current pricing page for the model you plan to use before you build anything that runs at volume.
• Behaviour: log the status code, the model name you sent and the first part of each response while you are developing, so you can see what changed if something stops working.

Common mistakes#

• Putting the key in front-end code or a public repository. Anyone can copy it.
• Copying a model name from an old tutorial. Names change, and the request fails.
• Planning around a quoted limit. Limits differ by model and tier, and they change. Verify.
• No retry or error handling. A single temporary failure should not break your app.
• Sending sensitive data on an unreviewed tier. Read the data terms first.
• Skipping the prompt test. Try the prompt in AI Studio first, so you know whether the problem is the prompt or the code.

Which one should you actually use?#

• Just want help with a task? Use the Gemini app.
• Want to tune a prompt before building? Use AI Studio.
• Building it into software? Use the API, with the key on the server.
• Not sure which model assistant fits your business? Read Claude vs ChatGPT vs Gemini: how a small business should choose.

Your next step#

Create a key, run the script above with a current model name from AI Studio, and confirm you get a 200. Then move the call behind your own server endpoint and add the retry helper. Environment variables can also fail in surprising ways, as in how one missing env var took down an entire site, so confirm the key is actually loaded before you debug anything else.

If you want an AI model connected to your own site or tools, with the approval steps and key handling done properly, that is covered on the AI automation service page. For the bigger idea behind it, see what agentic AI is.