Registered agent using gemini returns API key not valid

Plugins Machine Learning
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.5.0

Describe the issue:

Following the documentation on Register agent - OpenSearch Documentation I have registered an agent:

POST /_plugins/_ml/agents/_register
{
  "name": "opensearch agent",
  "type": "conversational",
  "description": "Test conversational agent",
  "model": {
    "model_id": "gemini-2.5-pro",
    "model_provider": "gemini/v1beta/generatecontent",
    "credentials": {
      "api_key": "xyz"
    },
    "parameters": {
      "system_prompt": "You are an expert data analyst with access to OpenSearch indices"
    }
  },
  "tools": [
    {
      "type": "ListIndexTool"
    },
    {
      "type": "SearchIndexTool"
    }
  ],
  "memory": {
    "type": "conversation_index"
  }
}

But when testing it:

POST /_plugins/_ml/agents/TmMRQJ0Ba60ZVyos9x8l/_execute
{
  "input": "What tools do you have access to?"
}

It returns the following error:

{
  "status": 400,
  "error": {
    "type": "OpenSearchStatusException",
    "reason": "Invalid Request",
    "details": "Error from remote service: {\n  \"error\": {\n    \"code\": 400,\n    \"message\": \"API key not valid. Please pass a valid API key.\",\n    \"status\": \"INVALID_ARGUMENT\",\n    \"details\": [\n      {\n        \"@type\": \"type.googleapis.com/google.rpc.ErrorInfo\",\n        \"reason\": \"API_KEY_INVALID\",\n        \"domain\": \"googleapis.com\",\n        \"metadata\": {\n          \"service\": \"generativelanguage.googleapis.com\"\n        }\n      },\n      {\n        \"@type\": \"type.googleapis.com/google.rpc.LocalizedMessage\",\n        \"locale\": \"en-US\",\n        \"message\": \"API key not valid. Please pass a valid API key.\"\n      }\n    ]\n  }\n}\n"
  }
}

The API key I’m using is correct, it’s working when used in another tool.

2

Two issues in your registration:

  1. Credential key name: The Gemini model provider expects gemini_api_key, not api_key. Internally, the connector sets the HTTP header x-goog-api-key: ${credential.gemini_api_key} ([source](https://github.com/opensearch-
    project/ml-commons/blob/main/common/src/main/java/org/opensearch/ml/common/agent/GeminiV1BetaGenerateContentModelProvider.java#L91)). Since your key is named api_key, the substitution produces an empty value, and Google
    rejects it with “API key not valid.”

  2. Field name: Should be credential (singular), not credentials.

Change your registration to:

json
“model”: {
“model_id”: “gemini-2.5-pro”,
“model_provider”: “gemini/v1beta/generatecontent”,
“credential”: {
“gemini_api_key”: “your-actual-api-key”
},
“parameters”: {
“system_prompt”: “You are an expert data analyst with access to OpenSearch indices”
}
}

References:

3

Thanks, this works.
For reference, a PUT with the updated fields didn’t resolve it, I had to delete the agent, and register it again with the correct parameters.