[Bug] 403 Forbidden on gemini-4-argon via OmniRoute: Caller lacks permission for aicode-consumers (Pro Subscription)

[0xDefton3s]

Bug Description

When trying to use gemini-4-argon through Antigravity / OmniRoute, the requests fail with a 403 Forbidden upstream error stating that the caller lacks the required permissions for the aicode-consumers Google Cloud project.

Note: The account being used has an active Pro subscription, yet it triggers this project-level permission block.

Error Message

[antigravity/gemini-4-argon] [403]: Antigravity upstream error (403): Caller does not have required permission to use project aicode-consumers. Grant the caller the roles/serviceusage.serviceUsageConsumer role, or a custom role with the serviceusage.services.use permission, by visiting https://console.developers.google.com/iam-admin/iam?project=aicode-consumers and then retry. Propagation of the new permission may take a few minutes. (reset after 5m)

Context & What Happens

• Despite having a Pro subscription, requests to gemini-4-argon are blocked by upstream IAM checks on the Google-managed aicode-consumers project.
• I tried visiting the provided link and submitted an access request, but I was unable to make any progress or bypass the restriction.
• Since aicode-consumers is an external/managed Google Cloud project rather than a user-owned project, standard users cannot grant themselves the required role.
• What should we do in this situation to resolve the issue? Any guidance or help would be greatly appreciated.

Expected Behavior

Requests to gemini-4-argon via OmniRoute should authenticate successfully for Pro tier users without triggering project-level IAM permission blocks for aicode-consumers.

Environment

• Proxy/Tool: OmniRoute
• Model: gemini-4-argon
• Account Tier: Pro Subscription

[diegosouzapw]

@0xDefton3s Thanks for the report. What I can verify: gemini-4-argon (with -high/-medium/-low variants) is in OmniRoute's Antigravity model list on v3.8.52. The error text itself comes from Google: the upstream says your account's request isn't permitted to use the Google Cloud project aicode-consumers (role roles/serviceusage.serviceUsageConsumer). That is a decision on Google's side for the account/project, and OmniRoute can't grant that permission. I haven't found anything in OmniRoute that sets that project from our side, and I can't tell whether the "Pro subscription" is supposed to cover this model, so I can't say it's a bug in OmniRoute.

To narrow it: does another Antigravity model (for example a Gemini 3.x one) work on the same connection, or do all of them return this 403? And did the connection show as connected after a fresh login? If only gemini-4-argon is blocked, it's most likely an access restriction on that model for the account.

[0xDefton3s]

Thanks for the quick response and info!

I ran the tests you suggested, and here is how it looks:

• All other Gemini 3.x and Antigravity models work completely fine on the same connection.
• Even if I do a fresh login with a clean account, the issue persists.
• This 403 error only pops up exclusively on gemini-4-argon and its variants.
• The weird part is that I can use the argon model perfectly fine through the gemini web interface on the same account. So the account itself has access, but it breaks specifically via the API/proxy route.

Since web access works fine while the API route gets blocked on that aicode-consumers permission just for this model, do you have any idea why this might be happening or what we could check next?

[diegosouzapw]

@0xDefton3s Thank you, that's useful and it changes what I'd conclude: the other Gemini 3.x and Antigravity models work, a fresh login with a clean account doesn't help, only gemini-4-argon and its variants return the 403, and the same account can use the model in the Gemini web app. That points at how the Antigravity channel is allowed to use that specific model (the 403 names a project, aicode-consumers, on Google's side), and not at your account or key.

I can't change that from OmniRoute, and I haven't found any place where OmniRoute sets that project; the request goes out with the account's own project. I haven't reproduced it (I have no account with the model). Two possibilities I can't distinguish: Google restricts gemini-4-argon on the Antigravity channel for some accounts, or the model needs a request detail OmniRoute doesn't send. If you can, please paste the exact request OmniRoute logged for a failed call (Dashboard → Logs, headers/keys hidden) and say whether you're on the Antigravity IDE card or the CLI card, so we can compare with a working case.

[0xDefton3s]

Thanks for getting back to me and looking into this!

To give you more context on my setup:

• I am using OmniRoute via VS Code (with OmniCopilot extension), connected through Antigravity, not via CLI.
• However, just to be thorough, I also tested it via CLI and experienced the exact same issue.
• Interestingly, I can use gemini-4-argon perfectly fine without any issues using the official Antigravity application and the VS Code extension.

Here are the exact request and response payloads from OmniRoute logs for a failed call:

Response Payload (Legacy)

{
"antigravityValidation": {
"httpStatus": 403,
"providerCode": 403,
"providerStatus": "PERMISSION_DENIED"
}
}

---

Request Payload (Legacy)

{
"model": "antigravity/gemini-4-argon",
"messages": [
{
"role": "user",
"content": "Reply with exactly: pong"
}
],
"max_tokens": 64,
"stream": true,
"reasoning_effort": "none"
}

[malikilinc]

I have the same issue. I’m using Omniroute with the latest version of npm. The Google Pro account I added via Connections links shows version Gemini 3.8 (But, Antigravity VS Code extension shows Argon 4). When I add Argon 4 as a custom model in Omniroute, I also get a 403 error.

[diegosouzapw]

@0xDefton3s Thank you, the payloads help. What the logged call shows: OmniRoute sent the model id exactly as gemini-4-argon (bare) with reasoning_effort: "none", and Google answered PERMISSION_DENIED (403).

One thing I can see in the code (v3.8.52): in OmniRoute's Antigravity model list, Gemini 4 Argon is listed only as tiered ids, gemini-4-argon-high, -medium and -low (taken from what the live model list reports for the CLI), and there is no bare gemini-4-argon entry for Antigravity. A bare id that Google doesn't advertise for that channel could well be refused. I haven't tested that, and you said the variants fail too, so it may not be the whole story, but it's cheap to check. Could you try these two on the same connection and tell us the result:

1. antigravity/gemini-4-argon-medium
2. antigravity/gemini-4-argon-high (with reasoning_effort left unset, not none)

If a tier id works, the bare name is the problem and we can map it. If they also return 403 with the same body, it's on Google's side for that channel, and the official Antigravity app likely uses a different client identity than OmniRoute's.

[0xDefton3s]

Thanks for the update!

I went ahead and tested the exact variants you suggested on the same connection:

1. antigravity/gemini-4-argon-medium
2. antigravity/gemini-4-argon-high (with reasoning_effort left unset)

Unfortunately, the issue persists, and both variants return the exact same 403 PERMISSION_DENIED error with the aicode-consumers project message. So it seems it's not just about the bare model ID.

Response Payload (Legacy)

{
"antigravityValidation": {
"httpStatus": 403,
"providerCode": 403,
"providerStatus": "PERMISSION_DENIED"
}
}

---

Request Payload (Legacy)

{
"model": "antigravity/gemini-4-argon-high",
"messages": [
{
"role": "user",
"content": "Reply with exactly: pong"
}
],
"max_tokens": 64,
"stream": true,
"reasoning_effort": "none"
}

[diegosouzapw]

@0xDefton3s Thanks for running both. Since -medium and -high fail with the same 403 body, the bare id isn't the cause, so my guess was wrong.

What's left points at Google's side. aicode-consumers is a Google-managed project, not one OmniRoute chooses or sends (it appears nowhere in our code), so neither you nor OmniRoute can grant that role. Other Antigravity models on the same connection work for you, so the block is specific to Gemini 4 Argon for this sign-in. Whether Google limits that model to its own Antigravity client or to certain accounts, I can't tell from here, and I have no way to test it.

I don't have a fix to offer. If anyone gets gemini-4-argon working through OmniRoute's Antigravity provider, please post your OmniRoute version and the model id here so we can compare. Until then, the other Antigravity models are the working route.

[0xDefton3s]

Thanks for looking into this and testing it out with me anyway. I completely understand. It really seems like a strict Google-side limitation or client-identity check specifically for that model on third-party channels.

By the way, if you'd like to test or inspect anything further on your end to figure out what's causing it, I'd be more than happy to share or give you temporary access to my account for testing via a private channel (like Discord or email) if there's a way to reach out.

Thanks again for your time and help

[diegosouzapw]

Thanks @0xDefton3s, I appreciate the offer, but please don't share access to your Google account with me or anyone else here. It also wouldn't settle this: the check happens on Google's side, so a test from your account would show the same 403 without telling us why Google refuses it. I'll leave the thread open in case someone gets gemini-4-argon working and can compare setups.

[malikilinc]

The Argon 4 has arrived at Antigravity IDE. I think the Omniroute model will be available soon.