Deleting a GCP API key does not cut it off right away. That leaves a short but real window where a stolen key can keep working after the console shows it gone, so the standard revoke-and-forget response misses the part that still accepts requests. Joe Leon measured a median 16-minute revocation delay and a maximum of 23 minutes for GCP API keys. The behavior differs from service accounts and Gemini API keys, and it matters most on projects where Gemini is enabled because those lingering requests can still reach uploaded files and cached conversations. The risk is not that deletion fails on paper. It is that backend acceptance lags long enough to give an attacker a usable post-deletion window, even when operators believe access has already been cut off.
Part of the PlainSec briefing for 2026-05-23