fix(gemini): use x-goog-api-key header to prevent dual-auth 400 error

.github/workflows/tests.yml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

agent/auxiliary_client.py

@@ -1593,6 +1593,9 @@ def _wrap_if_needed(client_obj, final_model_str: str, base_url_str: str = ""):
             from hermes_cli.models import copilot_default_headers
 
             headers.update(copilot_default_headers())
+        elif "generativelanguage.googleapis.com" in base_url.lower():
+            headers["x-goog-api-key"] = api_key
+            api_key = ""
 
         client = OpenAI(api_key=api_key, base_url=base_url,
                         **({"default_headers": headers} if headers else {}))

run_agent.py

@@ -981,6 +981,11 @@ def __init__(
                     }
                 elif "portal.qwen.ai" in effective_base.lower():
                     client_kwargs["default_headers"] = _qwen_portal_headers()
+                elif "generativelanguage.googleapis.com" in effective_base.lower():
+                    client_kwargs["api_key"] = ""
+                    client_kwargs["default_headers"] = {
+                        "x-goog-api-key": api_key,
+                    }
             else:
                 # No explicit creds — use the centralized provider router
                 from agent.auxiliary_client import resolve_provider_client

tests/hermes_cli/test_gemini_provider.py

@@ -211,6 +211,23 @@ def test_gemini_agent_uses_chat_completions(self, monkeypatch):
             assert agent.api_mode == "chat_completions"
             assert agent.provider == "gemini"
 
+    def test_gemini_uses_x_goog_api_key_header(self, monkeypatch):
+        """Gemini endpoint uses x-goog-api-key header instead of Bearer token (#7893)."""
+        monkeypatch.setenv("GOOGLE_API_KEY", "AIzaSy-test-key")
+        with patch("run_agent.OpenAI") as mock_openai:
+            mock_openai.return_value = MagicMock()
+            from run_agent import AIAgent
+            AIAgent(
+                model="gemini-2.5-flash",
+                provider="gemini",
+                api_key="AIzaSy-test-key",
+                base_url="https://generativelanguage.googleapis.com/v1beta/openai",
+            )
+            call_kwargs = mock_openai.call_args.kwargs
+            assert call_kwargs["api_key"] == ""
+            assert call_kwargs["default_headers"]["x-goog-api-key"] == "AIzaSy-test-key"
+            assert "Authorization" not in call_kwargs.get("default_headers", {})
+
 
 # ── models.dev Integration ──