You tried to run the Stitch MCP server with antigravity and the Gemini CLI and it failed with an auth error.
The tools report that API keys are not supported and that OAuth2 credentials are required.
Stitch MCP fails with API key against Cloud endpoint
The issue shows up as a tool error and Streamable HTTP error in the terminal. A typical message reads:
API keys are not supported by this API. Expected OAuth2 access token or other authentication credentials that assert a principal.
See https://cloud.google.com/docs/authentication
This means your setup is calling a Google Cloud endpoint that requires OAuth2 rather than the AI Studio API which accepts an API key.
If you also see antigravity failing to load or initialize models during this setup, check this targeted guide to rule out unrelated environment issues: troubleshooting model loading in antigravity.
Solution Overview
| Aspect | Detail |
|---|---|
| Root Cause | API key used against a Google Cloud endpoint that only accepts OAuth2 or ADC |
| Primary Fix | Authenticate with OAuth2 using Google Cloud Application Default Credentials or a service account and point tools at the Cloud endpoint |
| Complexity | Easy |
| Estimated Time | 10 to 20 minutes |
Fix authentication for Stitch MCP and Gemini CLI
Step-by-Step Solution
1. Identify which endpoint your tools are calling
- If your base URL is aiplatform.googleapis.com you are on the Google Cloud Vertex AI endpoint which requires OAuth2.
- If your base URL is generativelanguage.googleapis.com you can use an API key from AI Studio.
You can often see the base URL in the tool logs or verbose mode. If unsure, proceed with OAuth2 which works for the Cloud endpoint.
2. Preferred fix use OAuth2 via Application Default Credentials
- Install the Google Cloud CLI and sign in.
Commands:
gcloud auth application-default login
gcloud config set project YOUR_PROJECT_ID
- Verify you can mint a token and call the Cloud Gemini endpoint.
Commands:
export PROJECT_ID=YOUR_PROJECT_ID
export LOCATION=us-central1
export ACCESS_TOKEN=$(gcloud auth application-default print-access-token)
curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
"https://${LOCATION}-aiplatform.googleapis.com/v1/projects/${PROJECT_ID}/locations/${LOCATION}/publishers/google/models/gemini-1.5-flash:generateContent" \
-d '{
"contents": [{"role":"user","parts":[{"text":"Say hello"}]}]
}'You should see a JSON response with model output. If you get a permission or API not enabled error, enable the APIs then retry.
Docs:
3. Point your tools at ADC instead of an API key
- Remove any API key environment for Cloud usage.
Commands:
unset GOOGLE_API_KEY
unset GEMINI_API_KEY
- Ensure the environment where the Stitch MCP server runs can read ADC. That is automatic on your machine after the command in step 2. If your tool runs in a sandbox or container, pass through the ADC files and env.
Common setups:
- ADC user creds live under ~/.config/gcloud/application_default_credentials.json
- Many runtimes also accept GOOGLE_APPLICATION_CREDENTIALS pointing to a JSON key. With ADC you do not need this, but if your runtime insists you can export it.
Example:
export GOOGLE_APPLICATION_CREDENTIALS="$HOME/.config/gcloud/application_default_credentials.json"- Restart the Stitch MCP server and the Gemini CLI so they pick up the new credentials.
4. Alternative for servers use a service account key
Only do this when you cannot run user login ADC.
Commands:
export PROJECT_ID=YOUR_PROJECT_ID
gcloud iam service-accounts create mcp-client --display-name="MCP Client"
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
--member="serviceAccount:mcp-client@${PROJECT_ID}.iam.gserviceaccount.com" \
--role="roles/aiplatform.user"
gcloud iam service-accounts keys create "$HOME/mcp-sa-key.json" \
--iam-account="mcp-client@${PROJECT_ID}.iam.gserviceaccount.com"
export GOOGLE_APPLICATION_CREDENTIALS="$HOME/mcp-sa-key.json"Test with the curl from step 2 and then run your tools in the same shell so they inherit the env.
5. If you must keep an API key switch to the AI Studio endpoint
Some CLIs and SDKs can be told to use the AI Studio base URL. Using an API key only works with generativelanguage.googleapis.com.
Commands:
export GOOGLE_API_KEY=YOUR_AI_STUDIO_KEY
curl -s -H "Content-Type: application/json" \
-H "x-goog-api-key: $GOOGLE_API_KEY" \
"https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:generateContent" \
-d '{
"contents": [{"role":"user","parts":[{"text":"Say hello"}]}]
}'If this succeeds while the Cloud call fails with the API key message, your configuration was pointing at the Cloud endpoint.
Keep in mind many MCP servers that integrate with Google Cloud products are designed for OAuth2 and may not offer an API key mode.
Between steps, if antigravity triggers fail frequently due to limits during testing, see this quota oriented help to avoid false alarms: handling trigger quota issues in antigravity.
Alternative Fixes and Workarounds
- Run the MCP server locally with inherited ADC
If your editor like Cursor or a hosted shell cannot access your desktop ADC, start the MCP server locally in a terminal where you ran gcloud auth application-default login and connect the client to that server.
- Use a short lived access token in tools that accept a bearer token
Commands:
ACCESS_TOKEN=$(gcloud auth application-default print-access-token)
Then configure the tool to send Authorization Bearer ACCESS_TOKEN. Renew the token when it expires.
- Enable the correct API and region
If you are on Google Cloud, ensure the Vertex AI API is enabled and you choose a supported region such as us central1. For AI Studio, ensure your key is active and not restricted.
If you keep running into environment specific failures in antigravity while you test these fixes, this quick primer can help you isolate model load from auth configuration: why models fail to load in antigravity.
Troubleshooting Tips
- Confirm APIs are enabled
Enable Vertex AI API for the project if you use the Cloud endpoint.
- Check IAM roles
Your user or service account needs roles aiplatform.user at minimum. Add additional roles only as required.
- Verify token freshness
Commands:
gcloud auth application-default print-access-token
If this fails, rerun gcloud auth application-default login.
- Inspect endpoint selection in your tool
If it silently picks aiplatform then API keys will fail. Switch to OAuth2 or force the generativelanguage base URL for key based calls.
- Check region and model availability
Use a supported location and model. See model availability.
- Watch for rate limits
Frequent retries can look like auth failures in clients. See Vertex AI quotas. For antigravity specific rate limits, this note can help you interpret trigger quota errors correctly: trigger quota behavior explained.
Best Practices
- Prefer OAuth2 or ADC for any Google Cloud endpoint
API keys are only for AI Studio endpoints.
- Keep auth separate from config
Store project and region in config and keep credentials in ADC or secret stores.
- Use least privilege IAM roles
Grant only the roles your MCP server needs.
- Avoid embedding long lived keys
Favor ADC or short lived tokens and rotate service account keys if you must use them.
- Pin and log the base URL
Log the resolved base URL at startup so auth mismatches are obvious.
Final Thought
The error is clear once you map auth to the right endpoint. Use OAuth2 ADC for Cloud endpoints or switch to the AI Studio endpoint for API keys and your Stitch MCP server and Gemini CLI will operate normally.