Authentication

@orcushq/gemini communicates with the Gemini Web endpoint. It does not require an Orcus API key or a Gemini API key. Every request requires two authentication values from a valid signed-in Gemini Web session: the session cookies and the XSRF token.

The SDK does not sign in, discover browser credentials, refresh expired sessions, or read environment variables automatically. Your application must obtain the credentials, load any environment variables, and pass the values to GeminiWeb. See Find required keys to learn how to obtain these values.

Required credentials

• `cookies` - Required. Pass the complete Cookie header from your signed-in Gemini Web session, including all cookie name-value pairs. The SDK sends this value as the HTTP Cookie header.
• `xsrfToken` - Required. Pass the XSRF token associated with the same session. This is the value of the at field in the Gemini Web request payload. Pass the token value, not the field name. The SDK does not automatically fetch or refresh this token.

Both values must be configured for the authenticated setup. The SDK rejects requests without required authentication credentials with GeminiAuthenticationError. Successful local validation does not guarantee that the session is still valid or accepted by Gemini Web.

Configure credentials

Store both values in server-side environment variables or a secrets manager. The variable names below are examples chosen by your application; the SDK does not read them automatically. Keep the .env file out of version control.

GEMINI_COOKIES="your_complete_cookie_header"GEMINI_XSRF_TOKEN="your_at_value"

Initialize the client

import 'dotenv/config'import { GeminiWeb } from '@orcushq/gemini' const cookies = process.env.GEMINI_COOKIESconst xsrfToken = process.env.GEMINI_XSRF_TOKEN if (!cookies?.trim() || !xsrfToken?.trim()) {  throw new Error(    'GEMINI_COOKIES and GEMINI_XSRF_TOKEN are required',  )} const model = new GeminiWeb({  model: 'gemini-3.6-flash',  cookies,  xsrfToken,}) const response = await model.invoke('Say hello')console.log(response.content)