Gemini provider

You can proxy requests to Gemini AI models through AI Gateway by creating AI Model Provider and AI Model entities. This reference documents all supported AI capabilities, configuration requirements, and provider-specific details needed for proper integration.

AI Gateway supports both Gemini Standard and Gemini Enterprise. The following sections cover both variants together and note where their capabilities differ.

AI Gateway automatically routes requests to the appropriate Gemini API endpoints. The following table shows the upstream paths used for each capability.

The following tables show the AI capabilities supported by the Gemini provider when configuring AI Models.

By default, AI Gateway uses the path templates shown in the tables below (e.g., /chat/completions, /embeddings, etc.). To customize these paths, configure the config.paths field in your AI Model entity. Custom paths take the form {configured_path}/{template_path} — for example, if you set a custom path of /v2, requests to /embeddings would be routed to /v2/embeddings.

Text generation

Support for Gemini text generation capabilities:

Embeddings

Support for Gemini embeddings generation:

Image

Support for Gemini image generation and editing capabilities:

For requests with large payloads, consider increasing config.max_request_body_size on your AI Model entity to three times the raw binary size.

Supported image sizes and formats vary by model. Refer to your provider’s documentation for allowed dimensions and requirements.

Video

Support for Gemini video generation capabilities:

For requests with large payloads (video generation), consider increasing config.max_request_body_size on your AI Model entity to three times the raw binary size.

Realtime

Support for Gemini’s bidirectional streaming for realtime applications:

Realtime processing uses WebSocket protocol (ws/wss). This protocol is automatically enabled when you configure your AI Model with the realtime capability.

¹ Gemini Standard: Realtime processing for Gemini is supported in the native format from SDK only

Batches

Support for Gemini batch processing capabilities:

² Gemini Standard: Batches processing for Gemini is supported in the native format from SDK only

Batches are configured on a separate AI Model with type: "api", distinct from regular models that handle synchronous capabilities like generate and embeddings. Create a dedicated AI Model exclusively for batches and files, as each model must be either a regular model or an API model, not both.

Files

Support for Gemini file management capabilities:

³ Gemini Standard: Files processing for Gemini is supported in the native format from SDK only ⁴ Gemini Enterprise: Gemini Enterprise does not have a dedicated Files API. File storage uses Google Cloud Storage, similar to AWS S3.

Batches are configured on a separate AI Model with type: "api", distinct from regular models that handle synchronous capabilities like generate and embeddings. Create a dedicated AI Model exclusively for batches and files, as each model must be either a regular model or an API model, not both.## Gemini base URL By default, AI Gateway routes Gemini requests to Gemini Standard at https://generativelanguage.googleapis.com.

Setting config.gcp_environment (with api_endpoint, location_id, and project_id) on the AI Model’s target. This switches routing to Gemini Enterprise at https://aiplatform.googleapis.com/.

AI Gateway uses the correct URL automatically based on this configuration. You only need to set upstream_url in your AI Model configuration if you’re using a self-hosted or Gemini-compatible endpoint instead.

By default, AI Gateway uses OpenAI-compatible request formats. Configure a native format in your AI Model to use Gemini-specific APIs and features.

The following native Gemini formats are supported:

Provider-specific limitations for native formats

Gemini Standard:

• Gemini only supports auth.allow_override = false.

Gemini Enterprise:

• None.

To use Gemini with AI Gateway, configure a new AI Model Provider. You can then access supported AI Models from Gemini.

Gemini Standard

Here’s a minimal configuration for chat completions, authenticating with an API key:

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/model-providers \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Gemini Production",
      "name": "my-gemini-account",
      "type": "gemini",
      "config": {
        "auth": {
          "type": "basic",
          "headers": [
            {
              "name": "x-goog-api-key",
              "value": "'$GEMINI_API_KEY'"
            }
          ]
        }
      }
    }
    '

ai_gateway_model_providers:
  - ref: my-gemini-account
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Gemini Production
    name: my-gemini-account
    type: gemini
    config:
      auth:
        type: basic
        headers:
        - name: x-goog-api-key
          value: !secret {source: !env GEMINI_API_KEY}

Gemini Enterprise

Gemini Enterprise requires GCP credentials instead of an API key. The provider only handles authentication; auth.type: gcp by itself doesn’t select Gemini Enterprise, since Gemini Standard can use the same GCP auth. What actually routes to Gemini Enterprise is config.gcp_environment on the AI Model’s target that attaches to this provider.

Create the provider to store your GCP credentials:

kongctl apply -f - --auto-approve --pat "$KONNECT_TOKEN" << 'EOF'
ai_gateway_model_providers:
  - ref: my-gemini-enterprise-account
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: my-gemini-enterprise-account
    display_name: "Gemini Enterprise Production"
    type: gemini
    config:
      auth:
        type: gcp
        use_gcp_service_account: true
        service_account_json: !env GCP_ACCOUNT_JSON
EOF

Then attach an AI Model to it, setting config.gcp_environment on the target to route to Gemini Enterprise:

kongctl apply -f - --auto-approve --pat "$KONNECT_TOKEN" << 'EOF'
ai_gateway_models:
  - ref: my-gemini-enterprise-model
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: my-gemini-enterprise-model
    display_name: "my-gemini-enterprise-model"
    type: model
    capabilities:
      - generate
    formats:
      - type: openai
    config:
      route:
        paths:
          - /v1
    targets:
      - name: gemini-2.5-flash
        provider: my-gemini-enterprise-account
        config:
          type: gemini
          gcp_environment:
            api_endpoint: us-east5-aiplatform.googleapis.com
            location_id: us-east5
            project_id: my-gcp-project-id
    policies: []
EOF

targets[].config.gcp_environment requires api_endpoint, location_id, and project_id together. Without it, this same provider would route to Gemini Standard instead.

Gemini Enterprise requires credentials from Google Cloud Platform (GCP). Gemini Standard can also use GCP credentials instead of an API key by setting auth to gcp.

The authentication chain follows the same order of precedence as the gcloud tool:

1. Service account JSON defined directly in the provider: auth.service_account_json.
2. Service account JSON defined in environment variable GCP_SERVICE_ACCOUNT.
3. Workload IAM role (for example, a GKE or deployment service account).
4. IAM role attached to the VM instance.

For restricted networks, override the default endpoints with auth.metadata_url or auth.oauth_token_url.

Instead of a static service account key, you can configure the GCP provider to obtain temporary GCP credentials through Workload Identity Federation, exchanging credentials from an external identity provider for short-lived GCP tokens. This applies to both Gemini Standard and Gemini Enterprise, since both authenticate through the same GCP Provider auth.

To use Workload Identity Federation, set auth.type to gcp and add a workload_identity_federation object:

• source (required): The identity provider used to obtain temporary GCP credentials. Currently, only aws_iam is supported.
• auth_json (optional): JSON configuration for the Workload Identity Federation token exchange, Google’s external_account credential config (audience, token URL, credential source, and optional service account impersonation URL). If not set, Kong falls back to the file path in the GOOGLE_APPLICATION_CREDENTIALS environment variable.

When source is aws_iam, provide AWS IAM credentials under aws to identify the AWS principal used in the token exchange, or omit them to fall back to the default AWS credentials provider chain (EC2 instance profiles, environment variables, and so on):

Here’s a configuration that authenticates with GCP by assuming an AWS IAM role:

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/model-providers \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Gemini Production",
      "name": "my-gemini-account",
      "type": "gemini",
      "config": {
        "auth": {
          "type": "gcp",
          "workload_identity_federation": {
            "source": "aws_iam",
            "aws": {
              "type": "aws",
              "assume_role_arn": "'$AWS_ASSUME_ROLE_ARN'",
              "role_session_name": "kong-gemini-wif"
            }
          }
        }
      }
    }
    '

ai_gateway_model_providers:
  - ref: my-gemini-account
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Gemini Production
    name: my-gemini-account
    type: gemini
    config:
      auth:
        type: gcp
        workload_identity_federation:
          source: aws_iam
          aws:
            type: aws
            assume_role_arn: !env AWS_ASSUME_ROLE_ARN
            role_session_name: kong-gemini-wif