The Google provider lets your voice agent speak and listen using Google's own models — including Speech-to-Speech with Gemini Live, where a single model hears the caller and answers in natural voice with no separate transcription step.
Both keys with no markup. This guide shows how to create each one and fill in the Key and Gemini Key fields.
Quick start
Prepare your Google Cloud project — enable the APIs and billing.
Create the Gemini Key — bound to a service account, restricted to the Gemini API.
Create the general Key — a plain API key for everything else.
Add both keys to your connection and save.
Check that it works with the Test API button.
How it works
The Google provider uses two different families of Google services, and Google issues a separate key for each:
Gemini services — Gemini Live (Speech-to-Speech), the Gemini LLM, and Gemini text-to-speech. These run on the Gemini API.
Classic Google Cloud services — Cloud Speech-to-Text and Cloud Text-to-Speech, used by cascaded templates.
Both keys are created in Google Cloud Console, but they aren't the same kind of key and they aren't interchangeable.
The Gemini API only accepts a key that is bound to a service account and restricted to it. A key with access to other Google APIs is rejected. That's Google's own security measure — keys published by accident were being picked up and reused across non-Gemini services, so Google tightened access to the Gemini family specifically.
The classic speech services have no such requirement, so the general key is an ordinary API key.
That's why the connection has two fields instead of one — and why it's worth filling in both up front. Keeping them apart also means a problem with one key never takes down the other side of your agent.
Why add both keys
BSG templates come in two types, and both are available to you:
Speech-to-Speech runs on Gemini Live and uses the Gemini Key.
Cascaded runs Speech-to-Text → LLM → Text-to-Speech and uses the Key, plus the Gemini Key whenever the LLM or the voice is Gemini.
Templates are filtered by industry and use case in the catalog — see Working with templates.
You point an agent at this connection later, on its Locales tab — one connection and voice per locale. With both keys already in place, that choice always works: any agent, either type, and no trip back to Google for another credential when you switch.
What you manage where
Where |
What you do there |
Enable the APIs, manage billing, and create both keys |
|
Paste both keys into the connection, enable it, and run Test API |
Billing, quota, and usage limits all sit on your Google account. Nothing is charged through BSG for these calls.
Step 1. Prepare your project
Use one Google Cloud project for both keys, so billing and usage stay in one place.
Open Google Cloud Console and select or create your project.
Make sure billing is enabled on it. The speech APIs won't run without it, and Gemini is rate-limited without it.
-
Go to APIs & Services → Library and enable the services your agents will use:
Gemini API
Cloud Speech-to-Text API
Cloud Text-to-Speech API
Cloud Translation API, if your agent translates
Step 2. Create the Gemini Key
This one needs a service account behind it — that's what makes it acceptable to the Gemini API.
Go to APIs & Services → Credentials and click Create credentials → API key.
Choose the option to authenticate API calls through a service account. Until you do, the Gemini API isn't offered in the restrictions list.
Under Select API restrictions, tick Gemini API.
Pick the service account to bind the key to. The selector appears once a Gemini or Agent Platform API is selected.
Create the key and copy it straight away.
Leave Agent Platform API unticked unless you know you need it — the connection doesn't use it.
If key creation is blocked, an organization policy is likely in the way: binding API keys to service accounts is governed by policy on projects that belong to a Google Cloud organization. Ask your Google Cloud administrator to allow it, or use a project with no organization attached.
Step 3. Create the general Key
This is an ordinary API key — no service account, no mandatory restrictions.
Still under APIs & Services → Credentials, click Create credentials → API key again.
Copy the key. It works as it is, unrestricted.
Restricting it is optional but recommended. Open the key, choose Restrict key under API restrictions, and select only the speech APIs you enabled in step 1. That way an exposed key can't be used against anything else in your project.
One thing not to do: don't add Gemini API to this key. Gemini access comes from the service-account-bound key in step 2, and mixing the two is what Google's restrictions are designed to prevent.
Step 4. Add both keys to your connection
Open your connection in the Voice Agent cabinet and go to the Settings tab.
Check that Provider reads google. This field is read-only — it's fixed when the connection is created, so if it shows a different provider you'll need a new connection.
Paste your Google Cloud key into Key.
Paste your Gemini key into Gemini Key.
Tick Enabled so agents can use the connection.
Click Save.
Both fields are masked. Use the eye icon beside a field to reveal what you've pasted — worth doing once before you save, since a trailing space copied along with the key is a common cause of a rejected credential.
Checking that it works
Click Test API at the top of the connection. A working pair of keys returns a success result straight away, with no need to build an agent first.
Open the Logs tab for the detail. Latest Requests lists recent calls to the provider, newest first, with a refresh control: the Method that ran, the Status (Success on a healthy request), the Reason behind that status, and the Date. A failed request carries Google's own explanation in the Reason column — BSG passes it through rather than replacing it with its own message.
The problems you're most likely to hit, in Google's wording:
API key not valid. Please pass a valid API key.
The key is mistyped, has extra whitespace, or has been pasted into the wrong field. Reveal the field and re-paste.
Requests from this API key are rejected on a Gemini call
The key in Gemini Key isn't bound to a service account, or isn't restricted to the Gemini API. Google also rejects keys its systems have flagged as publicly exposed. Create a fresh one following step 2 and replace it.
SERVICE_DISABLED or a 403 on a speech call
The relevant API isn't enabled on the Cloud project, or the general key's restrictions exclude it. Revisit steps 1 and 3.
429 / quota exceeded
You're on the free tier or have hit a project limit. Enable billing on the Google Cloud project, or request higher quota from Google.
For anything beyond these, see Google's API troubleshooting guide.
Keeping your keys safe
Treat both keys like passwords. Never commit them to a Git repository or ship them in client-side code — Google actively scans public repositories and disables keys it finds there. If a key is exposed, create the replacement in Cloud Console first, update the connection, and only then delete the old one, so your agent stays online through the swap.
Restricting the general key, even though it's optional, is worth the two minutes: it's the difference between an exposed key costing you some speech minutes and it reaching everything else in the project.
Related guides
Google references
Comments
0 comments
Article is closed for comments.