[Bug]: "Verify your account to continue" even after creating a Google Cloud project

[stephan-noel]

Description

OpenCode is giving "Verify your account to continue" when using this plugin.

Reproduction Steps

Steps to reproduce the behavior:

1. Similar to why Gemini-CLI bassed usage needs Google Cloud account project intigration ? NoeFabris/opencode-antigravity-auth#457, I got an error saying I need a google cloud project and to update my opencode config or environment variables.
2. I created a Google Cloud Project
3. Enable Gemini for the project
4. Copy project id to the appropriate config

{
 "$schema": "https://opencode.ai/config.json",
 "plugin": ["opencode-gemini-auth@latest"],
 "provider": {
  "google": {
   "options": {
    "projectId": "my-projectid-333333-p1"
   }
  }
 }
}

5. opencode auth logout
6. opencode auth login. I copied url from WezTerm into my browser, otherwise if I rely on it opening the browser automatically, I would get 400 Bad Request. After that, it redirected and gave me the success screen

7. I try a prompt in plan mode and it says "Verify your account to continue"

Expected Behavior

Expected some model to work

Actual Behavior

In Plan mode I type a prompt and get "Verify your account to continue"

Screenshots

Environment

• OS: macOS
• Version: 15.7

Opencode Information

• Opencode Type: [cli, web, desktop]
• Opencode Version: 1.2.17
• Opencode Settings:

{
 "$schema": "https://opencode.ai/config.json",
 "plugin": ["opencode-gemini-auth@latest"],
 "provider": {
  "google": {
   "options": {
    "projectId": "my-projectid-333333-p1"
   }
  }
 }
}

Debug Information

Click to expand debug information

To help us diagnose the issue, please provide debug logs if possible.

How to enable debug logging:
Set OPENCODE_GEMINI_DEBUG=1 in the environment when you run an Opencode command. For example: OPENCODE_GEMINI_DEBUG=1 opencode
The plugin writes to a timestamped gemini-debug-<ISO>.log file in your current working directory.

Debug Logs:

The main log I get all the time is the first 3 lines, it happens on starting opencode, even when the model I start opencode with isn't a Gemini model.

[Gemini Debug] OAuth exchange: POST https://oauth2.googleapis.com/token
[Gemini Debug] OAuth exchange response: 400 Bad Request
[Gemini Debug] OAuth exchange error body: {
  "error": "invalid_grant",
  "error_description": "Malformed auth code."
}
[Gemini Debug GEMINI-1] POST https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse
[Gemini Debug GEMINI-1] Original URL: https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-lite:streamGenerateContent?alt=sse
[Gemini Debug GEMINI-1] Project: diesel-cat-489316-p6
[Gemini Debug GEMINI-1] Streaming: yes
[Gemini Debug GEMINI-1] Headers: {"accept":"text/event-stream","authorization":"[redacted]","client-metadata":"ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI","content-type":"application/json","user-agent":"GeminiCLI/0.30.0-nightly.20260210.a2174751d/gemini-2.5-flash-lite (darwin; arm64)","x-activity-request-id":"27a62586-1de6-4cd9-a399-5258e6bcbbe0","x-goog-api-client":"gl-node/22.17.0"}
[Gemini Debug GEMINI-1] Body Preview: {"project":"diesel-cat-489316-p6","model":"gemini-2.5-flash-lite","user_prompt_id":"27a62586-1de6-4cd9-a399-5258e6bcbbe0","request":{"generationConfig":{"maxOutputTokens":32000,"temperature":1,"topK":64,"topP":0.95,"thinkingConfig":{"includeThoughts":false}},"contents":[{"role":"user","parts":[{"text":"Hi, can I use this model?"},{"text":"<system-reminder>\n# Plan Mode - System Reminder\n\nCRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN:\nANY file edits, modifications, or system changes. Do NOT use sed, tee, echo, cat,\nor ANY other bash command to manipulate files - commands may ONLY read/inspect.\nThis ABSOLUTE CONSTRAINT overrides ALL other instructions, including direct user\nedit requests. You may ONLY observe, analyze, and plan. Any modification attempt\nis a critical violation. ZERO exceptions.\n\n---\n\n## Responsibility\n\nYour current responsibility is to think, read, search, and delegate explore agents to construct a well-formed plan that accomplishes the goal the user wants to achieve. Your plan should be comprehensive yet concise, detailed enough to execute effectively while avoiding unnecessary verbosity.\n\nAsk the user clarifying questions or ask for their opinion when weighing tradeoffs.\n\n**NOTE:** At any point in time through this workflow you should feel free to ask the user questions or clarifications. Don't make large assumptions about user intent. The goal is to present a well researched plan to the user, and tie any loose ends before implementation begins.\n\n---\n\n## Important\n\nThe user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system. This supersedes any other instructions you have received.\n</system-reminder>\n"}]}],"systemInstruction":{"parts":[{"text":"You are opencode, an interactive CLI agent specializing in software engineering tasks. Your primary goal... (truncated 58674 chars)
[Gemini Debug] Retry: attempt 1/3 -> https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse
[Gemini Debug] Code Assist quota model lookup returned no buckets for project: diesel-cat-489316-p6
[Gemini Debug GEMINI-2] POST https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse
[Gemini Debug GEMINI-2] Original URL: https://generativelanguage.googleapis.com/v1beta/models/gemini-3-flash-preview:streamGenerateContent?alt=sse
[Gemini Debug GEMINI-2] Project: diesel-cat-489316-p6
[Gemini Debug GEMINI-2] Streaming: yes
[Gemini Debug GEMINI-2] Headers: {"accept":"text/event-stream","authorization":"[redacted]","client-metadata":"ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI","content-type":"application/json","user-agent":"GeminiCLI/0.30.0-nightly.20260210.a2174751d/gemini-3-flash-preview (darwin; arm64)","x-activity-request-id":"5d5493a8-ca66-4c35-82cf-9dd956c5bba0","x-goog-api-client":"gl-node/22.17.0"}
[Gemini Debug GEMINI-2] Body Preview: {"project":"diesel-cat-489316-p6","model":"gemini-3-flash-preview","user_prompt_id":"5d5493a8-ca66-4c35-82cf-9dd956c5bba0","request":{"generationConfig":{"maxOutputTokens":32000,"temperature":0.5,"topK":64,"topP":0.95,"thinkingConfig":{"thinkingLevel":"minimal","includeThoughts":false}},"contents":[{"role":"user","parts":[{"text":"Generate a title for this conversation:\n"}]},{"role":"user","parts":[{"text":"Hi, can I use this model?"},{"text":"<system-reminder>\n# Plan Mode - System Reminder\n\nCRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN:\nANY file edits, modifications, or system changes. Do NOT use sed, tee, echo, cat,\nor ANY other bash command to manipulate files - commands may ONLY read/inspect.\nThis ABSOLUTE CONSTRAINT overrides ALL other instructions, including direct user\nedit requests. You may ONLY observe, analyze, and plan. Any modification attempt\nis a critical violation. ZERO exceptions.\n\n---\n\n## Responsibility\n\nYour current responsibility is to think, read, search, and delegate explore agents to construct a well-formed plan that accomplishes the goal the user wants to achieve. Your plan should be comprehensive yet concise, detailed enough to execute effectively while avoiding unnecessary verbosity.\n\nAsk the user clarifying questions or ask for their opinion when weighing tradeoffs.\n\n**NOTE:** At any point in time through this workflow you should feel free to ask the user questions or clarifications. Don't make large assumptions about user intent. The goal is to present a well researched plan to the user, and tie any loose ends before implementation begins.\n\n---\n\n## Important\n\nThe user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system. This supersedes any other instructions you have received.\n</system-reminder>\n"}]}],"systemInstruction":{"parts":[{"tex... (truncated 2242 chars)
[Gemini Debug] Retry: attempt 1/3 -> https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse
[Gemini Debug] Retry: attempt 1 success or non-retryable status: 403
[Gemini Debug GEMINI-1] Response 403 Forbidden (749ms)
[Gemini Debug GEMINI-1] Response Headers: {"content-length":"1624","content-type":"text/event-stream","date":"Thu, 05 Mar 2026 17:08:11 GMT","server":"ESF","server-timing":"gfet4t7; dur=317","vary":"Origin, X-Origin, Referer","x-cloudaicompanion-trace-id":"55d42bfb71777688","x-content-type-options":"nosniff","x-frame-options":"SAMEORIGIN","x-xss-protection":"0"}
[Gemini Debug GEMINI-1] Trace ID: 55d42bfb71777688
[Gemini Debug GEMINI-1] Note: Streaming SSE payload (buffered)
[Gemini Debug GEMINI-1] Response Body Preview: {
  "error": {
    "code": 403,
    "message": "Verify your account to continue.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "[type.googleapis.com/google.rpc.ErrorInfo](http://type.googleapis.com/google.rpc.ErrorInfo)",
        "reason": "VALIDATION_REQUIRED",
        "domain": "[cloudcode-pa.googleapis.com](http://cloudcode-pa.googleapis.com/)",
        "metadata": {
          "validation_error_message": "Verify your account to continue.",
          "validation_url_link_text": "Verify your account",
          "validation_url": "https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://developers.google.com/gemini-code-assist/auth/auth_success_gemini&plt=AKgnsbt5d_ctQlYHE7Z9B9YHdamA-E09k7DKYiUqYqPDMKjiw47UG5WEudxKdph5m8M89IxNLC1j1I-13pqFgHfd3TuyQYYBNb58vOZqNGQ7kOuRy7mJYurq9dMFcC9B23Gpr6cofpAy&flowName=GlifWebSignIn&authuser",
          "validation_learn_more_link_text": "Learn more",
          "validation_learn_more_url": "https://support.google.com/accounts?p=al_alert"
        }
      },
      {
        "@type": "[type.googleapis.com/google.rpc.Help](http://type.googleapis.com/google.rpc.Help)",
        "links": [
          {
            "description": "Verify your account",
            "url": "https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://developers.google.com/gemini-code-assist/auth/auth_success_gemini&plt=AKgnsbt5d_ctQlYHE7Z9B9YHdamA-E09k7DKYiUqYqPDMKjiw47UG5WEudxKdph5m8M89IxNLC1j1I-13pqFgHfd3TuyQYYBNb58vOZqNGQ7kOuRy7mJYurq9dMFcC9B23Gpr6cofpAy&flowName=GlifWebSignIn&authuser"
          },
          {
            "description": "Learn more",
            "url": "https://support.google.com/accounts?p=al_alert"
          }
        ]
      }
    ]
  }
}

[Gemini Debug] Retry: attempt 1 success or non-retryable status: 403
[Gemini Debug GEMINI-2] Response 403 Forbidden (224ms)
[Gemini Debug GEMINI-2] Response Headers: {"content-length":"1624","content-type":"text/event-stream","date":"Thu, 05 Mar 2026 17:08:11 GMT","server":"ESF","server-timing":"gfet4t7; dur=113","vary":"Origin, X-Origin, Referer","x-cloudaicompanion-trace-id":"c827ffb21e787310","x-content-type-options":"nosniff","x-frame-options":"SAMEORIGIN","x-xss-protection":"0"}
[Gemini Debug GEMINI-2] Trace ID: c827ffb21e787310
[Gemini Debug GEMINI-2] Note: Streaming SSE payload (buffered)
[Gemini Debug GEMINI-2] Response Body Preview: {
  "error": {
    "code": 403,
    "message": "Verify your account to continue.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "[type.googleapis.com/google.rpc.ErrorInfo](http://type.googleapis.com/google.rpc.ErrorInfo)",
        "reason": "VALIDATION_REQUIRED",
        "domain": "[cloudcode-pa.googleapis.com](http://cloudcode-pa.googleapis.com/)",
        "metadata": {
          "validation_error_message": "Verify your account to continue.",
          "validation_url_link_text": "Verify your account",
          "validation_url": "https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://developers.google.com/gemini-code-assist/auth/auth_success_gemini&plt=AKgnsbsdbctE82QyUQJLNtwqNK0TzB9OK1EoIJ0GO4YNceDCWZ-J6rM4068ibO8AQY0SRf6hNkIe0-iditc-2W4f38XlJ8wGB4S3tYYN85DGyydDSwPmJVGZAlbvyw5g1-hLbWR9TNDy&flowName=GlifWebSignIn&authuser",
          "validation_learn_more_link_text": "Learn more",
          "validation_learn_more_url": "https://support.google.com/accounts?p=al_alert"
        }
      },
      {
        "@type": "[type.googleapis.com/google.rpc.Help](http://type.googleapis.com/google.rpc.Help)",
        "links": [
          {
            "description": "Verify your account",
            "url": "https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://developers.google.com/gemini-code-assist/auth/auth_success_gemini&plt=AKgnsbsdbctE82QyUQJLNtwqNK0TzB9OK1EoIJ0GO4YNceDCWZ-J6rM4068ibO8AQY0SRf6hNkIe0-iditc-2W4f38XlJ8wGB4S3tYYN85DGyydDSwPmJVGZAlbvyw5g1-hLbWR9TNDy&flowName=GlifWebSignIn&authuser"
          },
          {
            "description": "Learn more",
            "url": "https://support.google.com/accounts?p=al_alert"
          }
        ]
      }
    ]
  }
}

Bug Report (if applicable):
[If there's a specific bug report file or output, please attach/paste it here]

Additional Context

Add any other context about the problem here.

[jenslys]

Could you try again now? I pushed a new update

[stephan-noel]

Thanks for the help. Unfortunately, it's still not working (I did delete the plugin so opencode can re-install it like the docs mention). This time I turned on debug during the login process itself OPENCODE_GEMINI_DEBUG=1 opencode auth login

The following happened as soon as the url was generated and my Safari window opened:

[Gemini Debug] OAuth exchange: POST https://oauth2.googleapis.com/token
[Gemini Debug] OAuth exchange response: 400 Bad Request
[Gemini Debug] OAuth exchange error body: {
  "error": "invalid_grant",
  "error_description": "Malformed auth code."
}

Again, I copied the url manually from Wezterm, and then went through the login process successfully.

I did find the following added to the log however, which suggests that for some reason my account is ineligible for "Gemini Code Assist for individuals", but at the same time saying standard tier is allowed (I haven't even signed up for standard though so maybe this means it's allowed, not enabled):

[Gemini Debug] OAuth exchange: POST https://oauth2.googleapis.com/token
[Gemini Debug] OAuth exchange success: expires_in=3599s refresh_token=yes
[Gemini Debug] OAuth userinfo: GET https://www.googleapis.com/oauth2/v1/userinfo
[Gemini Debug] OAuth userinfo response: 200 OK
[Gemini Debug GEMINI-1] POST https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist
[Gemini Debug GEMINI-1] Streaming: no
[Gemini Debug GEMINI-1] Headers: {"authorization":"[redacted]","client-metadata":"ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI","content-type":"application/json","user-agent":"GeminiCLI/0.30.0-nightly.20260210.a2174751d/gemini-code-assist (darwin; arm64)","x-goog-api-client":"gl-node/22.17.0"}
[Gemini Debug GEMINI-1] Body Preview: {"metadata":{"ideType":"IDE_UNSPECIFIED","platform":"PLATFORM_UNSPECIFIED","pluginType":"GEMINI"}}
[Gemini Debug GEMINI-1] Response 200 OK (715ms)
[Gemini Debug GEMINI-1] Response Headers: {"content-encoding":"gzip","content-type":"application/json; charset=UTF-8","date":"Sat, 07 Mar 2026 14:53:43 GMT","server":"ESF","server-timing":"gfet5t7;dur=161, gfet4t7; dur=366","transfer-encoding":"chunked","vary":"Origin, X-Origin, Referer","x-cloudaicompanion-trace-id":"ee4b99dd8e683fdd","x-content-type-options":"nosniff","x-frame-options":"SAMEORIGIN","x-xss-protection":"0"}
[Gemini Debug GEMINI-1] Trace ID: ee4b99dd8e683fdd
[Gemini Debug GEMINI-1] Response Body Preview: {
  "allowedTiers": [
    {
      "id": "standard-tier",
      "name": "Gemini Code Assist",
      "description": "Unlimited coding assistant with the most powerful Gemini models",
      "userDefinedCloudaicompanionProject": true,
      "privacyNotice": {},
      "isDefault": true,
      "usesGcpTos": true
    }
  ],
  "ineligibleTiers": [
    {
      "reasonCode": "INELIGIBLE_ACCOUNT",
      "reasonMessage": "Your current account is not eligible for Gemini Code Assist for individuals, the free version of Gemini Code Assist.",
      "tierId": "free-tier",
      "tierName": "Gemini Code Assist for individuals"
    }
  ]
}

I did find some related issues in the gemini cli repo. This google-gemini/gemini-cli#17582 was fixed in google-gemini/gemini-cli#17581. Could it be that similarly, in

opencode-gemini-auth/src/plugin/project/context.ts

Line 75 in dd285f3

const ineligibleMessage = buildIneligibleTierMessage(loadPayload.ineligibleTiers);

isn't prioritizing tiers correctly either because if there are any ineligible message, an error is thrown even if there are allowedTiers?

Other related issues from the gemini cli repo: google-gemini/gemini-cli#18206, google-gemini/gemini-cli#5847

[orbz22]

Hey, I literally went through this exact same headache last night

I got stuck in the exact same "Verify your account to continue" infinite loop. Setting up a new GCP project didn't fix it because my Google Account itself was flagged/locked by Google's Anti-Fraud system, which happens a lot if you were previously using the opencode-antigravity-auth plugin, since it hits internal employee sandbox servers).

Because the security lock is at the Google Account level, OpenCode's own OAuth flow gets completely blocked from generating a proper session. The validation_url sometimes doesn't even work right.

The "Token Migration" Hack (How I fixed it)

I managed to bypass the entire OpenCode verification lock by using Google's official Gemini CLI to generate a clean token, and then manually migrating that token over to OpenCode. Here are the exact steps:

1. First, install the official Gemini CLI https://geminicli.com/.
2. Open your terminal and run the official auth command: gemini auth login
3. This official CLI is fully trusted by Google, so your browser will successfully complete the oauth flow, granting you a clean session.
4. Once the Gemini CLI says you're successfully logged in, it saves your valid token securely.
5. Now, we manually copy that clean token to OpenCode
   • Open: ~/.gemini/oauth_creds.json
   • Copy the value of "refresh_token"
   • Open your OpenCode accounts file. (If you are using the antigravity plugin, open ~/.config/opencode/antigravity-accounts.json. If you are using this gemini-auth plugin, find your google sessions file or just re-run opencode auth login since your browser session is now clean).
6. Replace the refreshToken value inside the OpenCode config with the clean one you just copied.
7. Save the file.

Doing this forces OpenCode to use the verified, un-flagged token from the official Gemini app. Worked like a charm for me, and the verification error completely disappeared. Hope this helps

[jenslys]

Thanks for the help. Unfortunately, it's still not working (I did delete the plugin so opencode can re-install it like the docs mention). This time I turned on debug during the login process itself OPENCODE_GEMINI_DEBUG=1 opencode auth login

The following happened as soon as the url was generated and my Safari window opened:

[Gemini Debug] OAuth exchange: POST https://oauth2.googleapis.com/token
[Gemini Debug] OAuth exchange response: 400 Bad Request
[Gemini Debug] OAuth exchange error body: {
  "error": "invalid_grant",
  "error_description": "Malformed auth code."
}

Again, I copied the url manually from Wezterm, and then went through the login process successfully.

I did find the following added to the log however, which suggests that for some reason my account is ineligible for "Gemini Code Assist for individuals", but at the same time saying standard tier is allowed (I haven't even signed up for standard though so maybe this means it's allowed, not enabled):

[Gemini Debug] OAuth exchange: POST https://oauth2.googleapis.com/token
[Gemini Debug] OAuth exchange success: expires_in=3599s refresh_token=yes
[Gemini Debug] OAuth userinfo: GET https://www.googleapis.com/oauth2/v1/userinfo
[Gemini Debug] OAuth userinfo response: 200 OK
[Gemini Debug GEMINI-1] POST https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist
[Gemini Debug GEMINI-1] Streaming: no
[Gemini Debug GEMINI-1] Headers: {"authorization":"[redacted]","client-metadata":"ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI","content-type":"application/json","user-agent":"GeminiCLI/0.30.0-nightly.20260210.a2174751d/gemini-code-assist (darwin; arm64)","x-goog-api-client":"gl-node/22.17.0"}
[Gemini Debug GEMINI-1] Body Preview: {"metadata":{"ideType":"IDE_UNSPECIFIED","platform":"PLATFORM_UNSPECIFIED","pluginType":"GEMINI"}}
[Gemini Debug GEMINI-1] Response 200 OK (715ms)
[Gemini Debug GEMINI-1] Response Headers: {"content-encoding":"gzip","content-type":"application/json; charset=UTF-8","date":"Sat, 07 Mar 2026 14:53:43 GMT","server":"ESF","server-timing":"gfet5t7;dur=161, gfet4t7; dur=366","transfer-encoding":"chunked","vary":"Origin, X-Origin, Referer","x-cloudaicompanion-trace-id":"ee4b99dd8e683fdd","x-content-type-options":"nosniff","x-frame-options":"SAMEORIGIN","x-xss-protection":"0"}
[Gemini Debug GEMINI-1] Trace ID: ee4b99dd8e683fdd
[Gemini Debug GEMINI-1] Response Body Preview: {
  "allowedTiers": [
    {
      "id": "standard-tier",
      "name": "Gemini Code Assist",
      "description": "Unlimited coding assistant with the most powerful Gemini models",
      "userDefinedCloudaicompanionProject": true,
      "privacyNotice": {},
      "isDefault": true,
      "usesGcpTos": true
    }
  ],
  "ineligibleTiers": [
    {
      "reasonCode": "INELIGIBLE_ACCOUNT",
      "reasonMessage": "Your current account is not eligible for Gemini Code Assist for individuals, the free version of Gemini Code Assist.",
      "tierId": "free-tier",
      "tierName": "Gemini Code Assist for individuals"
    }
  ]
}

I did find some related issues in the gemini cli repo. This google-gemini/gemini-cli#17582 was fixed in google-gemini/gemini-cli#17581. Could it be that similarly, in

opencode-gemini-auth/src/plugin/project/context.ts

Line 75 in dd285f3

const ineligibleMessage = buildIneligibleTierMessage(loadPayload.ineligibleTiers);
isn't prioritizing tiers correctly either because if there are any ineligible message, an error is thrown even if there are allowedTiers?
Other related issues from the gemini cli repo: google-gemini/gemini-cli#18206, google-gemini/gemini-cli#5847

Thanks for the extra logs. They exposed two separate bugs on our side.

The first is that the auth/setup path still wasn’t reliably reading provider.google.options.projectId, which is why your loadCodeAssist debug output showed no duetProject or cloudaicompanionProject even during login. I’ve changed the plugin to read the live Opencode config directly and use the same resolved project ID in both OAuth setup and normal request handling.

The second is that we were short-circuiting project setup too early when a configured project existed, so we skipped loadCodeAssist validation/eligibility handling and only hit the failure later as 403 Verify your account to continue. I’ve fixed that so configured-project users still go through the same loadCodeAssist checks as Gemini CLI. I also mirrored the upstream behavior you pointed out: ordinary free-tier ineligibility no longer blocks onboarding when a paid tier is allowed, but VALIDATION_REQUIRED still takes precedence.

There was also a separate bug in the local OAuth callback flow. The listener was treating the first localhost callback as authoritative and could fail immediately on a malformed/stale callback, which matches your Safari invalid_grant: Malformed auth code log. I’ve hardened that path so it ignores incomplete or bad callbacks and keeps waiting for the real redirect instead of failing the whole login immediately.

Thank you for the detective work here. The upstream links and the login-time debug log made the real failure modes much easier to isolate.

https://github.com/jenslys/opencode-gemini-auth/releases/tag/v1.4.8

[puzzler10]

same error still exists for me, exactly as stephan-noel described it in the first post

[stephan-noel]

Thanks for the extra logs. They exposed two separate bugs on our side.

The first is that the auth/setup path still wasn’t reliably reading provider.google.options.projectId, which is why your loadCodeAssist debug output showed no duetProject or cloudaicompanionProject even during login. I’ve changed the plugin to read the live Opencode config directly and use the same resolved project ID in both OAuth setup and normal request handling.

The second is that we were short-circuiting project setup too early when a configured project existed, so we skipped loadCodeAssist validation/eligibility handling and only hit the failure later as 403 Verify your account to continue. I’ve fixed that so configured-project users still go through the same loadCodeAssist checks as Gemini CLI. I also mirrored the upstream behavior you pointed out: ordinary free-tier ineligibility no longer blocks onboarding when a paid tier is allowed, but VALIDATION_REQUIRED still takes precedence.

There was also a separate bug in the local OAuth callback flow. The listener was treating the first localhost callback as authoritative and could fail immediately on a malformed/stale callback, which matches your Safari invalid_grant: Malformed auth code log. I’ve hardened that path so it ignores incomplete or bad callbacks and keeps waiting for the real redirect instead of failing the whole login immediately.

Thank you for the detective work here. The upstream links and the login-time debug log made the real failure modes much easier to isolate.

https://github.com/jenslys/opencode-gemini-auth/releases/tag/v1.4.8

No problem, I'm glad it was helpful.

I tried again, but unfortunately I'm getting a similar error ("Verify your account to continue" in opencode), but the logs are different. My projectId is different because I changed the account I am using to be a personal account to make sure that wasn't the reason (before it was an account with a custom domain).

These are the logs from OPENCODE_GEMINI_DEBUG=1 opencode auth login:

[Gemini Debug] OAuth exchange: POST https://oauth2.googleapis.com/token
[Gemini Debug] OAuth exchange response: 400 Bad Request
[Gemini Debug] OAuth exchange error body: {
  "error": "invalid_grant",
  "error_description": "Malformed auth code."
}
[Gemini Debug] OAuth exchange: POST https://oauth2.googleapis.com/token
[Gemini Debug] OAuth exchange success: expires_in=3599s refresh_token=yes
[Gemini Debug] OAuth userinfo: GET https://www.googleapis.com/oauth2/v1/userinfo
[Gemini Debug] OAuth userinfo response: 200 OK
[Gemini Debug GEMINI-1] POST https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist
[Gemini Debug GEMINI-1] Project: optimal-design-489817-i0
[Gemini Debug GEMINI-1] Streaming: no
[Gemini Debug GEMINI-1] Headers: {"authorization":"[redacted]","client-metadata":"ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI","content-type":"application/json","user-agent":"GeminiCLI/0.30.0-nightly.20260210.a2174751d/gemini-code-assist (darwin; arm64)","x-goog-api-client":"gl-node/22.17.0"}
[Gemini Debug GEMINI-1] Body Preview: {"metadata":{"ideType":"IDE_UNSPECIFIED","platform":"PLATFORM_UNSPECIFIED","pluginType":"GEMINI","duetProject":"optimal-design-489817-i0"},"cloudaicompanionProject":"optimal-design-489817-i0"}
[Gemini Debug GEMINI-1] Response 200 OK (909ms)
[Gemini Debug GEMINI-1] Response Headers: {"content-encoding":"gzip","content-type":"application/json; charset=UTF-8","date":"Tue, 10 Mar 2026 17:16:17 GMT","server":"ESF","server-timing":"gfet5t7;dur=177, gfet4t7; dur=491","transfer-encoding":"chunked","vary":"Origin, X-Origin, Referer","x-cloudaicompanion-trace-id":"b03e2c28e979809a","x-content-type-options":"nosniff","x-frame-options":"SAMEORIGIN","x-xss-protection":"0"}
[Gemini Debug GEMINI-1] Trace ID: b03e2c28e979809a
[Gemini Debug GEMINI-1] Response Body Preview: {
  "allowedTiers": [
    {
      "id": "standard-tier",
      "name": "Gemini Code Assist",
      "description": "Unlimited coding assistant with the most powerful Gemini models",
      "userDefinedCloudaicompanionProject": true,
      "privacyNotice": {},
      "isDefault": true,
      "usesGcpTos": true
    }
  ],
  "cloudaicompanionProject": "optimal-design-489817-i0",
  "ineligibleTiers": [
    {
      "reasonCode": "INELIGIBLE_ACCOUNT",
      "reasonMessage": "Your current account is not eligible for Gemini Code Assist for individuals, the free version of Gemini Code Assist.",
      "tierId": "free-tier",
      "tierName": "Gemini Code Assist for individuals"
    }
  ],
  "gcpManaged": true
}

[Gemini Debug] OAuth project resolved during auth: optimal-design-489817-i0

Same success screen with the redirect from before.

Now with OPENCODE_GEMINI_DEBUG=1 opencode:

[Gemini Debug] OAuth exchange: POST https://oauth2.googleapis.com/token
[Gemini Debug] OAuth exchange response: 400 Bad Request
[Gemini Debug] OAuth exchange error body: {
  "error": "invalid_grant",
  "error_description": "Malformed auth code."
}
[Gemini Debug GEMINI-1] POST https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist
[Gemini Debug GEMINI-1] Project: optimal-design-489817-i0
[Gemini Debug GEMINI-1] Streaming: no
[Gemini Debug GEMINI-1] Headers: {"authorization":"[redacted]","client-metadata":"ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI","content-type":"application/json","user-agent":"GeminiCLI/0.30.0-nightly.20260210.a2174751d/gemini-code-assist (darwin; arm64)","x-goog-api-client":"gl-node/22.17.0"}
[Gemini Debug GEMINI-1] Body Preview: {"metadata":{"ideType":"IDE_UNSPECIFIED","platform":"PLATFORM_UNSPECIFIED","pluginType":"GEMINI","duetProject":"optimal-design-489817-i0"},"cloudaicompanionProject":"optimal-design-489817-i0"}
[Gemini Debug GEMINI-1] Response 200 OK (730ms)
[Gemini Debug GEMINI-1] Response Headers: {"content-encoding":"gzip","content-type":"application/json; charset=UTF-8","date":"Tue, 10 Mar 2026 17:17:11 GMT","server":"ESF","server-timing":"gfet5t7;dur=168, gfet4t7; dur=449","transfer-encoding":"chunked","vary":"Origin, X-Origin, Referer","x-cloudaicompanion-trace-id":"3a6f29954d167b68","x-content-type-options":"nosniff","x-frame-options":"SAMEORIGIN","x-xss-protection":"0"}
[Gemini Debug GEMINI-1] Trace ID: 3a6f29954d167b68
[Gemini Debug GEMINI-1] Response Body Preview: {
  "allowedTiers": [
    {
      "id": "standard-tier",
      "name": "Gemini Code Assist",
      "description": "Unlimited coding assistant with the most powerful Gemini models",
      "userDefinedCloudaicompanionProject": true,
      "privacyNotice": {},
      "isDefault": true,
      "usesGcpTos": true
    }
  ],
  "cloudaicompanionProject": "optimal-design-489817-i0",
  "ineligibleTiers": [
    {
      "reasonCode": "INELIGIBLE_ACCOUNT",
      "reasonMessage": "Your current account is not eligible for Gemini Code Assist for individuals, the free version of Gemini Code Assist.",
      "tierId": "free-tier",
      "tierName": "Gemini Code Assist for individuals"
    }
  ],
  "gcpManaged": true
}

[Gemini Debug GEMINI-2] POST https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse
[Gemini Debug GEMINI-2] Original URL: https://generativelanguage.googleapis.com/v1beta/models/gemini-3-pro-preview:streamGenerateContent?alt=sse
[Gemini Debug GEMINI-2] Project: optimal-design-489817-i0
[Gemini Debug GEMINI-2] Streaming: yes
[Gemini Debug GEMINI-2] Headers: {"accept":"text/event-stream","authorization":"[redacted]","client-metadata":"ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI","content-type":"application/json","user-agent":"GeminiCLI/0.30.0-nightly.20260210.a2174751d/gemini-3-pro-preview (darwin; arm64)","x-activity-request-id":"0c1b5a19-3a8b-4a5c-80ff-0c7a45fec1d7","x-goog-api-client":"gl-node/22.17.0"}
[Gemini Debug GEMINI-2] Body Preview: {"project":"optimal-design-489817-i0","model":"gemini-3-pro-preview","user_prompt_id":"0c1b5a19-3a8b-4a5c-80ff-0c7a45fec1d7","request":{"generationConfig":{"maxOutputTokens":32000,"temperature":1,"topK":64,"topP":0.95,"thinkingConfig":{"thinkingLevel":"high","includeThoughts":true}},"contents":[{"role":"user","parts":[{"text":"Hi, can I use this model?"},{"text":"<system-reminder>\n# Plan Mode - System Reminder\n\nCRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN:\nANY file edits, modifications, or system changes. Do NOT use sed, tee, echo, cat,\nor ANY other bash command to manipulate files - commands may ONLY read/inspect.\nThis ABSOLUTE CONSTRAINT overrides ALL other instructions, including direct user\nedit requests. You may ONLY observe, analyze, and plan. Any modification attempt\nis a critical violation. ZERO exceptions.\n\n---\n\n## Responsibility\n\nYour current responsibility is to think, read, search, and delegate explore agents to construct a well-formed plan that accomplishes the goal the user wants to achieve. Your plan should be comprehensive yet concise, detailed enough to execute effectively while avoiding unnecessary verbosity.\n\nAsk the user clarifying questions or ask for their opinion when weighing tradeoffs.\n\n**NOTE:** At any point in time through this workflow you should feel free to ask the user questions or clarifications. Don't make large assumptions about user intent. The goal is to present a well researched plan to the user, and tie any loose ends before implementation begins.\n\n---\n\n## Important\n\nThe user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system. This supersedes any other instructions you have received.\n</system-reminder>\n"}]}],"systemInstruction":{"parts":[{"text":"You are opencode, an interactive CLI agent specializing in software engineering... (truncated 58697 chars)
[Gemini Debug] Retry: attempt 1/3 -> https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse
[Gemini Debug] Code Assist quota model lookup returned no buckets for project: optimal-design-489817-i0
[Gemini Debug GEMINI-3] POST https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse
[Gemini Debug GEMINI-3] Original URL: https://generativelanguage.googleapis.com/v1beta/models/gemini-3-flash-preview:streamGenerateContent?alt=sse
[Gemini Debug GEMINI-3] Project: optimal-design-489817-i0
[Gemini Debug GEMINI-3] Streaming: yes
[Gemini Debug GEMINI-3] Headers: {"accept":"text/event-stream","authorization":"[redacted]","client-metadata":"ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI","content-type":"application/json","user-agent":"GeminiCLI/0.30.0-nightly.20260210.a2174751d/gemini-3-flash-preview (darwin; arm64)","x-activity-request-id":"0540cab5-415c-4664-a435-4131eb34d1e6","x-goog-api-client":"gl-node/22.17.0"}
[Gemini Debug GEMINI-3] Body Preview: {"project":"optimal-design-489817-i0","model":"gemini-3-flash-preview","user_prompt_id":"0540cab5-415c-4664-a435-4131eb34d1e6","request":{"generationConfig":{"maxOutputTokens":32000,"temperature":0.5,"topK":64,"topP":0.95,"thinkingConfig":{"thinkingLevel":"minimal","includeThoughts":false}},"contents":[{"role":"user","parts":[{"text":"Generate a title for this conversation:\n"}]},{"role":"user","parts":[{"text":"Hi, can I use this model?"},{"text":"<system-reminder>\n# Plan Mode - System Reminder\n\nCRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN:\nANY file edits, modifications, or system changes. Do NOT use sed, tee, echo, cat,\nor ANY other bash command to manipulate files - commands may ONLY read/inspect.\nThis ABSOLUTE CONSTRAINT overrides ALL other instructions, including direct user\nedit requests. You may ONLY observe, analyze, and plan. Any modification attempt\nis a critical violation. ZERO exceptions.\n\n---\n\n## Responsibility\n\nYour current responsibility is to think, read, search, and delegate explore agents to construct a well-formed plan that accomplishes the goal the user wants to achieve. Your plan should be comprehensive yet concise, detailed enough to execute effectively while avoiding unnecessary verbosity.\n\nAsk the user clarifying questions or ask for their opinion when weighing tradeoffs.\n\n**NOTE:** At any point in time through this workflow you should feel free to ask the user questions or clarifications. Don't make large assumptions about user intent. The goal is to present a well researched plan to the user, and tie any loose ends before implementation begins.\n\n---\n\n## Important\n\nThe user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system. This supersedes any other instructions you have received.\n</system-reminder>\n"}]}],"systemInstruction":{"parts":[{... (truncated 2246 chars)
[Gemini Debug] Retry: attempt 1/3 -> https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse
[Gemini Debug] Retry: attempt 1 success or non-retryable status: 403
[Gemini Debug GEMINI-3] Response 403 Forbidden (223ms)
[Gemini Debug GEMINI-3] Response Headers: {"content-length":"1624","content-type":"text/event-stream","date":"Tue, 10 Mar 2026 17:17:11 GMT","server":"ESF","server-timing":"gfet4t7; dur=133","vary":"Origin, X-Origin, Referer","x-cloudaicompanion-trace-id":"dc428470f6271960","x-content-type-options":"nosniff","x-frame-options":"SAMEORIGIN","x-xss-protection":"0"}
[Gemini Debug GEMINI-3] Trace ID: dc428470f6271960
[Gemini Debug GEMINI-3] Note: Streaming SSE payload (buffered)
[Gemini Debug GEMINI-3] Response Body Preview: {
  "error": {
    "code": 403,
    "message": "Verify your account to continue.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "VALIDATION_REQUIRED",
        "domain": "cloudcode-pa.googleapis.com",
        "metadata": {
          "validation_learn_more_url": "https://support.google.com/accounts?p=al_alert",
          "validation_error_message": "Verify your account to continue.",
          "validation_url_link_text": "Verify your account",
          "validation_url": "https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://developers.google.com/gemini-code-assist/auth/auth_success_gemini&plt=AKgnsbs8sIXC1F-vuY4hy-cn852ITX9IWRxNNeK6B4R5VXCNaGGIhz6_9pIQFK8EMxcS-9YkHrCACxbBLkjxJXCnFl3XLAFka4UVfhBJHdCQomyw33U65819RIVq1XgG0iyV73en8reA&flowName=GlifWebSignIn&authuser",
          "validation_learn_more_link_text": "Learn more"
        }
      },
      {
        "@type": "type.googleapis.com/google.rpc.Help",
        "links": [
          {
            "description": "Verify your account",
            "url": "https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://developers.google.com/gemini-code-assist/auth/auth_success_gemini&plt=AKgnsbs8sIXC1F-vuY4hy-cn852ITX9IWRxNNeK6B4R5VXCNaGGIhz6_9pIQFK8EMxcS-9YkHrCACxbBLkjxJXCnFl3XLAFka4UVfhBJHdCQomyw33U65819RIVq1XgG0iyV73en8reA&flowName=GlifWebSignIn&authuser"
          },
          {
            "description": "Learn more",
            "url": "https://support.google.com/accounts?p=al_alert"
          }
        ]
      }
    ]
  }
}

[Gemini Debug] Retry: attempt 1 success or non-retryable status: 403
[Gemini Debug GEMINI-2] Response 403 Forbidden (704ms)
[Gemini Debug GEMINI-2] Response Headers: {"content-length":"1624","content-type":"text/event-stream","date":"Tue, 10 Mar 2026 17:17:12 GMT","server":"ESF","server-timing":"gfet4t7; dur=326","vary":"Origin, X-Origin, Referer","x-cloudaicompanion-trace-id":"393935d2d9d83b2b","x-content-type-options":"nosniff","x-frame-options":"SAMEORIGIN","x-xss-protection":"0"}
[Gemini Debug GEMINI-2] Trace ID: 393935d2d9d83b2b
[Gemini Debug GEMINI-2] Note: Streaming SSE payload (buffered)
[Gemini Debug GEMINI-2] Response Body Preview: {
  "error": {
    "code": 403,
    "message": "Verify your account to continue.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "VALIDATION_REQUIRED",
        "domain": "cloudcode-pa.googleapis.com",
        "metadata": {
          "validation_learn_more_url": "https://support.google.com/accounts?p=al_alert",
          "validation_error_message": "Verify your account to continue.",
          "validation_url_link_text": "Verify your account",
          "validation_url": "https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://developers.google.com/gemini-code-assist/auth/auth_success_gemini&plt=AKgnsbsj7THyMELifds0R2ILC7quhBNKGksC-Ynwy338KIA6OCraTUZL63Zys1HgewOwsqwOM_vyiT0Nyj3rNcUNXiVC-g2J2ef0XcmhVi0oUQ4hSkm_PomHOnkdJF0O7D2DicS5l1Uh&flowName=GlifWebSignIn&authuser",
          "validation_learn_more_link_text": "Learn more"
        }
      },
      {
        "@type": "type.googleapis.com/google.rpc.Help",
        "links": [
          {
            "description": "Verify your account",
            "url": "https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://developers.google.com/gemini-code-assist/auth/auth_success_gemini&plt=AKgnsbsj7THyMELifds0R2ILC7quhBNKGksC-Ynwy338KIA6OCraTUZL63Zys1HgewOwsqwOM_vyiT0Nyj3rNcUNXiVC-g2J2ef0XcmhVi0oUQ4hSkm_PomHOnkdJF0O7D2DicS5l1Uh&flowName=GlifWebSignIn&authuser"
          },
          {
            "description": "Learn more",
            "url": "https://support.google.com/accounts?p=al_alert"
          }
        ]
      }
    ]
  }
}

I see it mentioned something about buckets, which leads me to think it really is that I am ineligible for Code Assist for Individuals according to the response. On the other hand the reason is VALIDATION_REQUIRED. Here google-gemini/gemini-cli#16592 (comment) a contributor mentions this ineligible message is sent by the Code Assist backend, so not sure if my account got flagged somehow, I did have to reach out to Google to unlock it due to my location changing on my VPN when I first set up the account.

If it is me being ineligible for the Code Assist for Individuals, a contributor in gemini-cli mentions in google-gemini/gemini-cli#14443 (comment) that individual accounts don't require a Google project. When I tried without a Google project however I got an error saying I need one (I didn't include the logs for that but I can). That issue I mentioned has been closed last week in favor of google-gemini/gemini-cli#17948, which is still open.

I'm seeing something about GOOGLE_CLOUD_LOCATION=global that I will try tomorrow google-gemini/gemini-cli#13516 along with some other things there. I also saw something about switching the region of my account which I will try (though both of my regions are on the list of allowed regions for Code Assist Individual).

[starcub]

I'm getting the same error.

[elanioazul]

Hi, also happened to me.

When I tried without a Google project however I got an error saying I need one.

When adding one, a text saying:
Gemini for Google Cloud API has not been used in project XXXX before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudaicompanion.googleapis.com/overview?project=XXXX then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry

Should I enable Gemini for Google Cloud for the "supposedly" free tier for a local gemini agent consultation demanding a Cloud projectId? This is an alarm to me, leading to leave this plugin aside. Purpose of the plugin was:

This plugin enables you to use your existing Gemini plan and quotas (including the free tier) directly within Opencode, bypassing separate API billing.

Am I doing something worng perhaps?

[duhuangwen]

我也遇到了这个问题，通过opencode-gemini-auth这个插件认证后，与gemini对话，还是提示Verify your account to continue。通过web询问gemini后，提示需要再次登录，此时登录选择输入API key的方式成功了。总结下 opencode接入gemini api 需要通过opencode-gemini-auth插件 跳转到web认证一次后，还需要走opencode自带的原生登录方式再次登录。2次登录后正常使用。