Featured

How to fix Stitch MCP not working with API key in Antigravity?

by
Users trying to run the Stitch MCP server in antigravity or via the Gemini CLI get an immediate failure when tools like list_projects are called. The output shows an error that says API keys are not supported and that an OAuth two access token is required.

Stitch MCP API keys not supported error on antigravity and Gemini CLI

The core issue appears when invoking Stitch MCP tools such as list_projects. The response contains text like API keys are not supported by this API. Expected OAuth two access token or other authentication credentials that assert a principal. See the Google Cloud authentication docs. This means the server is calling a Google Cloud backed endpoint that rejects API keys and only accepts principal backed credentials, such as user OAuth tokens or service account credentials. Read More: Fix Stitch Mcp Api Key Antigravity

Solution Overview

AspectDetail
Root CauseThe Stitch MCP server is configured with an API key where the endpoint requires principal backed OAuth credentials
Primary FixRemove the API key and supply OAuth two credentials using Application Default Credentials or a service account key
ComplexityEasy
Estimated Time10 to 20 minutes

Fix authentication for Stitch MCP with OAuth

Step-by-Step Solution

Step 1 Remove any API key from your MCP server config
  • Open your MCP server configuration for Stitch and delete any apiKey entry.
  • Ensure your configuration allows the process to inherit environment variables for authentication.
Example JSON style configuration 
{
 "mcpServers": {
 "stitch": {
 "command": "stitch",
 "env": {
 "GOOGLE_APPLICATION_CREDENTIALS": "/absolute/path/to/service_account_key.json"
 }
 }
 }
}
If you are running Stitch inside antigravity or a local agent runner, make sure that environment variables from your shell are passed through to the process. Step 2 Option A use user OAuth with Application Default Credentials
  • Install the Google Cloud CLI if you have not already installed it. See the install page at Install Google Cloud CLI.
  • Sign in and set your project
gcloud auth login
gcloud config set project YOUR_PROJECT_ID
  • Leave GOOGLE_APPLICATION_CREDENTIALS unset. Libraries and many tools will discover the user credentials from gcloud automatically through Application Default Credentials. Details here Provide credentials to your application.
Restart antigravity or the Gemini CLI session so the process picks up your authenticated context. Step 3 Option B use a service account key JSON
  • In the Google Cloud console create a service account and grant at least viewer on your projects or the specific permission set that your Stitch tools require. See Service accounts and Project access control.
  • Download the JSON key for that service account.
  • Point Stitch MCP to the key by setting the environment variable before launching your agent or CLI
export GOOGLE_APPLICATION_CREDENTIALS="$HOME/path/service_account_key.json"
  • Start your agent session and run the tool again.
Step 4 Enable the required Google Cloud APIs
  • Make sure the Cloud Resource Manager API is enabled in the project referenced by your credentials. You can enable it here Cloud Resource Manager API.
Step 5 Re test the list projects tool
  • Run your Stitch MCP tool again. It should now return projects rather than the API keys are not supported error.
Read More: Fix Browser Agent Not Working Antigravity

Alternative Fixes & Workarounds

Use a short lived user token via an OAuth client
  • If your environment cannot run gcloud, authenticate with a standard OAuth client flow to obtain a bearer token for the user account and export it in the environment where your MCP server expects it. Ensure the token includes appropriate scopes and that your code attaches the Authorization header. See Google Cloud authentication overview.
Use a service account without a downloaded key
  • Prefer workload identity or similar methods to avoid storing keys. Stitch must run in an environment that can assert the service account identity. See Authentication best practices.
Read More: Fix Browser Agent Not Working Antigravity 2

Troubleshooting Tips

  • Confirm there is no leftover API key variable in your environment such as STITCH_API_KEY that might cause the client to pick an API key path.
  • Verify the active Google account and project with
gcloud auth list
gcloud config list
  • Check IAM roles on the user or service account. For listing projects you typically need viewer on the organization or membership on specific projects.
  • Ensure the process inherits credentials. If antigravity or your terminal session launches the MCP server in a clean environment, explicitly set GOOGLE_APPLICATION_CREDENTIALS in the launch configuration as shown above.
  • Update the Gemini CLI or agent runtime so that it supports MCP auth via Application Default Credentials.

Best Practices

  • Prefer principal backed auth for Google Cloud endpoints. API keys are often blocked because they do not assert identity.
  • Use least privilege roles on your user or service account and avoid granting owner.
  • Avoid long lived keys. Where possible use user login through gcloud or workload identity and rotate credentials frequently.
  • Keep a single source of truth for credentials and avoid mixing API keys with OAuth in the same config file.

Final Thought

This error happens because the endpoint needs identity backed OAuth credentials and it rejects API keys. Configure Stitch MCP to use user login or a service account and the tools like list projects will start working right away. For extra help with antigravity specific behavior and similar agent issues, see our internal guides linked above.

Leave a Comment