Vulnerabilities · 115 days ago
Deleting a GCP API key does not cut it off right away. That leaves a short but real window where a stolen key can keep working after the console shows it gone, so the standard revoke-and-forget response misses the part that still accepts requests.
Joe Leon measured a median 16-minute revocation delay and a maximum of 23 minutes for GCP API keys. The behavior differs from service accounts and Gemini API keys, and it matters most on projects where Gemini is enabled because those lingering requests can still reach uploaded files and cached conversations.
The risk is not that deletion fails on paper. It is that backend acceptance lags long enough to give an attacker a usable post-deletion window, even when operators believe access has already been cut off.
3 sources covering this story
Deleted Google API keys keep working for up to 23 minutes, researchers warn - Help Net Security
Security researchers found that deleted Google API keys remain valid for up to 23 minutes, leaving a window for attackers to exploit them.
Threat hunters find Google API keys still usable 23 minutes after deletion
Plenty of time for cyber crims to grab data or hit you with a giant bill
Google API Keys Remain Active After Deletion
A security researcher discovered the API keys can still be used for 23 minutes after deletion, even though the cloud provider claims deletion is immediate.
Part of the PlainSec briefing for 2026-05-23