Google Gen AI SDK for Java 1

Last reviewed Oct 25, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. Google Gen AI SDK for Java 165 lines · 3.3K tokens
Total178 lines · 6.2K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 94
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 294
  • 295
  • 297
  • 319
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 488
  • 494
  • 502
  • 532
  • 611
  • 639
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333
  • 1426
  • 1427

Prompt Preview

Apply the Java 25 baseline first. These rules cover the Google Gen AI Java SDK's active 1.x line across the Gemini Developer API and Gemini Enterprise Agent Platform. The SDK builds Java 8 bytecode; Java 25 is the deployment baseline used for this composition.

Client identity and request construction

  • Construct Client from trusted application configuration. Choose .enterprise(true) or .enterprise(false) explicitly, and keep project, location, API version, model and provider credential outside request and model control. Resolve conflicting backend flags and environment variables at startup instead of accepting the SDK's precedence as an authorization decision.
  • Keep Developer API keys on a trusted server, restrict them to the intended API and deployment, and set one key source; GOOGLE_API_KEY takes precedence over GEMINI_API_KEY. For Enterprise, give Application Default Credentials only the needed project permissions and keep GOOGLE_APPLICATION_CREDENTIALS files and federation configuration under deployment control.
  • Use separate clients and provider projects where workloads require different identities, regions or quotas. Authenticate the application caller and check ownership of every provider resource; possession of a resource name or shared Google credential is not tenant authorization.
  • Build GenerateContentConfig, HttpOptions, Interactions requests and tool declarations from allowlisted application fields. Never pass an inbound object through to httpOptions, extraBody, headers, baseUrlResourceScope, apiVersion, tool configuration or