Unexpected Gemini API bill: what happened and what to do

The Gemini API bills by the token, and some of its models are expensive per request. With a stolen key running image generation in parallel, a bill can grow by thousands of dollars an hour. In February 2026 a three-person startup was charged $82,314.44 in about two days, against a normal month of about $180 (The Register).

If your bill or a budget alert just showed a spike, stop the spending first. Work out the cause after.

Stop the spending now

Billing data runs behind. Google says cost details are "typically" available within a day and can take longer (Cloud Billing reports). Whatever you see now is old, and if a key is being abused, the real total is higher and still growing.

If you don't know yet which key it is, the fastest stop is turning the API off for the whole project:

gcloud services disable generativelanguage.googleapis.com --project=PROJECT_ID --force

This breaks every Gemini feature in the project until you turn it back on with gcloud services enable. If the charges are running, that's the right trade.

If you know the key, delete it:

gcloud services api-keys delete KEY_ID --project=PROJECT_ID --no-check-existing-usage

Without --no-check-existing-usage, the command refuses to delete a key that had traffic in the last seven days, which an abused key always has. You can restore a deleted key within 30 days with gcloud services api-keys undelete KEY_ID.

If you set the key up in AI Studio, you can delete it there too, under API keys.

Work out the cause

Most surprise Gemini bills come from one of four places.

A leaked or stolen key

The most expensive cause by far. Signs:

• models you don't use, especially image or video models
• traffic at hours when your app is quiet
• usage from a key that's meant for something else, like a Maps or Firebase key

Until June 2026, any unrestricted key in a project with Gemini enabled could call it, including Maps and Firebase keys published in web pages. Google now rejects unrestricted keys, but a key whose restrictions include Gemini still works. Can your Google Maps API key call Gemini? covers how to check every key.

Your own code

A retry loop that never gives up, an agent that keeps calling itself, a cron job that runs every minute instead of every day. These look like a single key at a steady, high rate, calling the models you normally use. Requests that fail with a 400 or 500 error aren't billed, but they still count against your quota (Gemini billing docs).

A model or feature that costs more than you expected

From the Gemini API pricing page in October 2026:

• Thinking tokens are billed as output. A short answer from a thinking model can carry thousands of output tokens you never see.
• Long prompts cost more. Gemini 3.1 Pro Preview charges $2 per million input tokens and $12 per million output tokens up to 200,000 prompt tokens, and $4 and $18 above that.
• Images are priced per image. Gemini 3 Pro Image costs $0.134 per 1K or 2K image and $0.24 per 4K image. Image models have no free tier.
• Grounding with Google Search is charged per request once you pass the free allowance: $14 per 1,000 on Gemini 3 models, after 5,000 free a month.

Moving off the free tier

A project with no billing account uses the free tier. Once you link a billing account in AI Studio, the project moves to a paid tier, and so does every other project on that billing account (rate limits and tiers). Code that ran free for months starts costing money the day someone adds a card, even if nobody changed the code.

Find which key and which model

Cloud Billing reports

In the Google Cloud console, open Billing > Reports. Filter Services to Gemini API and group by SKU. The SKU names include the model and the kind of usage, for example input tokens, output tokens or image output. A SKU for a model you never call is the clearest sign of abuse.

Billing reports can't break costs down by API key. For that, use request metrics.

Request metrics per key

1. Open Monitoring > Metrics explorer.
2. Choose the resource type Consumed API and the metric Request count.
3. Filter service to generativelanguage.googleapis.com.
4. Group by credential_id.

Each line is one key. Line up the jump in requests with the jump in the billing report, and you have the key and the hour it started.

AI Studio

AI Studio has a usage dashboard and a Spend page with costs per project, which you can filter by model. Google says the Spend page can take up to 24 hours to update (Gemini billing docs).

Save what you find as you go. Export the billing report as CSV and take screenshots of the metrics. You'll need them in the next step.

Ask Google for an adjustment

If a key was stolen, contact Cloud Billing support to report it and ask about a billing adjustment. Google says it reviews these case by case (resolving billing issues). If you don't have a billing account but were charged, use the unknown charges form.

Outcomes in 2026 have been mixed:

• In May 2026, after reporting by The Register, Google refunded the two people named in the story and said it would review more cases. Another user, charged $127,000, was still waiting (The Register).
• One developer charged $8,367.11 was first offered a 90% adjustment, then got the rest from a billing specialist about three weeks later (forum thread).
• The startup charged $82,314.44 was told the charges stood under the shared responsibility model. No refund had been reported when The Register covered it.

What helps your case:

• A timeline. When the key leaked, if you know. When you noticed, when you stopped it, and when the unauthorized usage started and ended.
• Evidence that the usage wasn't yours. Models you never call, traffic from a key that serves Maps, requests at hours your app is idle.
• Proof you closed the hole. The key deleted, the API disabled or restricted, and the source of the leak found.

Go to Google before your bank. A bank dispute becomes a chargeback that Google reviews itself, and if it disagrees, the charge stays. Leaving a postpay invoice unpaid while you argue can also get the Cloud Billing account suspended (resolving billing issues).

Make the next one smaller

• Set a spend cap. AI Studio has a monthly spend cap per project. Cloud Billing also has spend cap budgets for the Gemini API that pause it once a project reaches its budget. Both can run a little over before they kick in. Billing spike alerts and spend caps walks through both.
• Know your tier cap. Each billing account also has a monthly cap by tier: $250 on Tier 1 and $2,000 on Tier 2 (Gemini billing docs). Reaching it pauses every project on the billing account until the next month, so set your own cap lower.
• Keep the key on your server. Call Gemini from your backend. A key in a web page or a mobile app will be found.
• One project for Gemini. Keep it apart from your public Maps and Firebase keys, so they can never be given access to it.
• Watch per-key usage, not just the bill. A bill tells you the next day. Request counts tell you within the hour. How to automatically revoke an abused API key shows how to act on them without waiting for a person.

How Keyll handles this

Keyll watches request counts for every key in a Google Cloud project and compares each key with its own history. A key that jumps to eight times its usual peak, or starts calling a model it never used, sets off an alert. If the abuse keeps going for 10 minutes, Keyll warns you, then blocks that one key while the rest of the project keeps working. Each incident comes with a report and a CSV export for the billing case. Keyll hasn't launched yet. Join the waitlist to get one email when it does.

Checklist

• Abused key deleted, or the Gemini API disabled in the project
• Cause found: leaked key, own code, pricing or tier change
• Billing report exported by SKU, per-key metrics saved
• Billing case opened with a timeline
• Spend cap set on the Gemini project
• Remaining keys restricted and kept off the client