Home / Blog / Pricing

Pricing

Gemini CLI Error 403 "The caller does not have permission": How to Fix It

Gemini CLI returning 403 "The caller does not have permission"? Causes by login type (Google account, API key, Vertex) and the fixes from GitHub issues.

By Engineer Foodie Desk ✓ Sources checked Nov 3, 2026

8 min read

Error text checked Nov 3, 2026 in Google’s official Gemini CLI repo (#25754, #25306, #24517, #29107). Auth steps checked Nov 3, 2026 in Gemini CLI’s authentication docs and Google Cloud’s Gemini setup page. 403 meanings checked Nov 3, 2026 in the Gemini API errors and troubleshooting pages. The Login with Google cutoff was checked Oct 29, 2026 on codeassist.google. Every source is listed at the bottom. No affiliate links on this page (how we work).

The finding first: a Gemini CLI 403 is a “who are you” problem, not a “slow down” problem. Retrying won’t fix it. Google’s own API guide says “Do not retry on client errors (like 400, 402, or 403)”. The fix depends entirely on how you signed in. And if you’re an individual or Google AI Pro/Ultra subscriber signing in with Google, the answer may be that this route doesn’t exist anymore. Google ended it on June 18, 2026.

The exact error: “The caller does not have permission”

Here it is word for word from #25754 (Gemini CLI 0.38.2, signed in with Google):

✕ [API Error: [{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "errors": [
      {
        "message": "The caller does not have permission",
        "domain": "global",
        "reason": "forbidden"
      }
    ],
    "status": "PERMISSION_DENIED"
  }
}
]]

One-line answer: Google accepted who you are but refused the request, because the account, key or project you’re using isn’t allowed to call that Gemini service.

Searching the repo for “The caller does not have permission” turns up 52 issues as of Nov 3, 2026. The biggest was #24517, labeled priority P1, with 168 comments. A Google AI Pro subscriber’s /stats showed “Auth Method: Signed in with Google” and the correct tier, but “No tokens are consumed — requests are rejected before processing.” A maintainer closed #25754 as a duplicate of the tracking issue for 403 errors.

403 by auth method

Gemini CLI has three ways in, per its authentication docs. The 403 means something different for each.

Sign in with Google (personal account)

This is where nearly all the issue reports come from, with oauth-personal in the CLI’s bug-report output. The big cluster landed in April 2026: #24517, #25306 and #25754 are all Google AI Pro or Ultra subscribers who’d paid and were still locked out. In #25306, a user traced the requests to the Code Assist endpoint (cloudcode-pa.googleapis.com) and argued that the CLI was treating the AI Pro plan as a Code Assist license. That’s a user’s analysis, not Google’s. In #24517, another commenter pointed to Google Developer Program wording that AI Pro and Ultra benefits “can only be redeemed by the subscription owners and not by Google account family members”. If you’re on a family plan, that’s worth checking.

On May 4, 2026, a contributor posted in both threads that updates to Google’s “resource management policies” were “fully deployed”. Both issues were then closed as not planned. Users later replied in #25306 that it wasn’t fixed, in July and August 2026. A follow-up issue, #29107, was opened in August and marked stale in late October with no fix.

Then the bigger change hit. Google’s Code Assist page says: “Starting June 18, 2026, Gemini Code Assist IDE extensions stopped serving requests for the Gemini Code Assist for individuals, Google AI Pro, and Google AI Ultra tiers. This also applies to usage of Gemini CLI. As part of the deprecation, you can no longer use the Login with Google option to access the IDE extensions or Gemini CLI” (verified Oct 29, 2026). The CLI’s own docs carry a banner as of Nov 3, 2026: “Unpaid tier and Google One users: Gemini CLI was replaced by Antigravity CLI on June 18th, 2026.”

So, in plain terms: if you’re an individual signing in with a personal Google account, a 403 can’t be fixed with a setting. You need a different auth method or a different tool. That’s a rough deal for people who paid for AI Pro partly for the CLI, and honestly it’s frustrating. The auth docs page still tells AI Pro and Ultra subscribers to “use the Google account associated with your subscription”. One page says yes and the banner says no.

Sign in with Google (Workspace, school, or a Code Assist license)

Here a 403 usually means a project problem. Per the auth docs, you need a Google Cloud project if you use “a Company, School, or Google Workspace account” or a Gemini Code Assist license. The setup steps are to find your project ID, “Enable the Gemini for Cloud API”, “Configure necessary IAM access permissions”, and set GOOGLE_CLOUD_PROJECT. Skip any one and you get the bouncer. By order of the Peaky Blinders: no project, no entry.

Gemini API key

Google’s errors page defines 403 PERMISSION_DENIED as: “Your API key does not have permission for this resource, or your project’s API access is restricted.” Its fix: “Check your API key permissions, project tier eligibility, and billing status.”

The troubleshooting page goes further. If your project shows Restricted, Free tier unavailable, Payment needed or Unavailable in AI Studio:

  • Free tier unavailable: “Creating a new API key in the same project won’t resolve the error.” Eligibility is checked per project. The documented fix is to move to the paid tier by linking a Cloud Billing account.
  • Payment needed: clear the past-due balance or update the payment method, and “your project regains API access automatically”.
  • Leaked or blocked key: generate a new key on the AI Studio API Keys page and swap it into your environment.

Vertex AI

Per the auth docs, Vertex needs GOOGLE_CLOUD_PROJECT set to a project “with the Vertex AI API enabled” and GOOGLE_CLOUD_LOCATION set. For a service account, the docs say to assign the “Vertex AI User” role and point GOOGLE_APPLICATION_CREDENTIALS at the JSON key. If GOOGLE_API_KEY or GEMINI_API_KEY is still set, unset it before using gcloud credentials, or the CLI may pick the wrong identity.

How to fix Gemini CLI 403

  1. Check which method you’re actually on. /stats shows the auth method, as in #24517, and /auth will “Open a dialog that lets you change the authentication method” (commands reference). A lot of 403s come down to “I thought I was using my API key”.
  2. Personal Google account? Login with Google ended for individuals and AI Pro/Ultra on June 18, 2026. Switch to a Gemini API key (export GEMINI_API_KEY="...", then pick “Use Gemini API key”), use Vertex AI, or move to Antigravity CLI as the docs banner says.
  3. Workspace or Code Assist license? Enable the API in your project: gcloud services enable cloudaicompanion.googleapis.com. Then grant Gemini for Google Cloud User (roles/cloudaicompanion.user) and Service Usage Consumer (roles/serviceusage.serviceUsageConsumer), per Google Cloud’s setup page. Set GOOGLE_CLOUD_PROJECT to that project. Your admin may need to do the IAM part.
  4. API key? Check the project’s status in AI Studio. If it says free tier unavailable or payment needed, fix billing on that project. A new key in the same project won’t help.
  5. Vertex? Confirm the Vertex AI API is enabled, the location is set, and your account or service account has Vertex AI User.
  6. VS Code Code Assist extension too? One #25306 user cleared the geminicodeassist.project setting and it worked. That’s a user report, not a documented fix.
  7. Update the CLI. npm install -g @google/gemini-cli@latest (troubleshooting). It won’t fix a permissions problem, but it rules out stale auth code.

What not to do: spin up fresh Google accounts to dodge it. That’s account farming, and none of the fixes above need it. Like Slough House in Slow Horses, the back door only leads somewhere worse.

403 vs 429 vs 400 vs 503

CodeMeaningPost
403No permissionThis page
429Quota or rateGemini CLI 429
400Bad requestGemini CLI 400
503OverloadedGemini CLI 503

Google’s errors page puts quota under 429 RESOURCE_EXHAUSTED and permissions under 403. A 403 isn’t a quota problem, even though #24517’s reporter saw 429s before the 403s started.

Here’s what I’d do

Run /stats and read the auth line. If it says you’re signed in with a personal Google account, stop debugging. That door closed on June 18, 2026. Set up a Gemini API key from AI Studio and check the project’s status page before your first prompt. If you’re on Workspace, send your admin the two role names and the gcloud services enable line above. That’s usually a five-minute fix on their end.

For what the free options look like after the cutoff, see Gemini CLI free tier limits. If you’re weighing a switch, there’s Gemini CLI vs Claude Code and the wider AI coding tools compared.

FAQ

What does The caller does not have permission mean in Gemini CLI? It’s a 403 PERMISSION_DENIED: Google recognized your account, key or project but won’t let it call that Gemini service.

Is Gemini CLI 403 a quota problem? No, Google’s errors page lists quota as 429 RESOURCE_EXHAUSTED; a 403 is about permissions, project eligibility or billing.

How do I fix Gemini CLI 403 with an API key? Check the key’s project in AI Studio for Restricted, Free tier unavailable or Payment needed, and fix billing there; a new key in the same project won’t help.

Can I still sign in with Google in Gemini CLI on AI Pro? No, Google says Login with Google stopped working for individuals and Google AI Pro and Ultra on June 18, 2026.

Should I retry a Gemini CLI 403? No, Google’s API troubleshooting says not to retry 403 errors because they point to key, project or billing problems.

Sources

  1. Google Gemini CLI GitHub issue #25754 (verbatim 403 error, closed as duplicate of the 403 tracking issue): https://github.com/google-gemini/gemini-cli/issues/25754 (verified 2026-11-03)
  2. Google Gemini CLI GitHub issue #25306, “The caller does not have permission”: https://github.com/google-gemini/gemini-cli/issues/25306 (verified 2026-11-03)
  3. Google Gemini CLI GitHub issue #24517, “403 PERMISSION_DENIED for Google One AI Premium subscriber”: https://github.com/google-gemini/gemini-cli/issues/24517 (verified 2026-11-03)
  4. Google Gemini CLI GitHub issue #29107, “The caller does not have permission #25306 - still persists”: https://github.com/google-gemini/gemini-cli/issues/29107 (verified 2026-11-03)
  5. Gemini CLI docs, authentication setup: https://geminicli.com/docs/get-started/authentication/ (verified 2026-11-03)
  6. Gemini CLI docs, commands reference (/auth, /stats): https://geminicli.com/docs/reference/commands/ (verified 2026-11-03)
  7. Gemini CLI docs, troubleshooting: https://geminicli.com/docs/resources/troubleshooting/ (verified 2026-11-03)
  8. Google Cloud, set up Gemini Code Assist (enable API, IAM roles): https://cloud.google.com/gemini/docs/discover/set-up-gemini (verified 2026-11-03)
  9. Gemini API errors (403, 429, 400, 503 codes): https://ai.google.dev/gemini-api/docs/api-errors (verified 2026-11-03)
  10. Gemini API troubleshooting (project restricted or unavailable, retry guidance): https://ai.google.dev/gemini-api/docs/troubleshooting (verified 2026-11-03)
  11. Gemini Code Assist consumer accounts (Login with Google ended June 18, 2026): https://codeassist.google/ (verified 2026-10-29)

Related reading