Google API Keys Remain Active After Deletion

A security researcher discovered the API keys can still be used for 23 minutes after deletion, even though the cloud provider claims deletion is immediate.

Google API keys aren't completely inactive after users delete them, giving attackers a small but significant window to continue abusing them.

Joe Leon, researcher at Belgian startup Aikido Security, recently analyzed the revocation window — the time between a key's deletion and its last successful authentication — for the cloud giant's API keys . In a blog post published today, Leon said Google Cloud Platform (GCP) customers expect API access to end immediately after the key is deleted, but this is not the case.

In a series of tests, Leon found that the median revocation window was around 16 minutes, while the longest window weas up to 23 minutes, "an incredibly long time" for API keys to continue authenticating successfully, he said.

And these windows have serious repercussions for organizations. "An attacker holding your deleted key can keep sending requests until one reaches a server that has not caught up. If Gemini is enabled on the project, they can dump files you have uploaded and exfiltrate cached conversations," Leon said. "The GCP console will not show the key, and it will not tell you the key is still working. You are trusting Google's infrastructure to eventually catch up."

Leon tells Dark Reading he was inspired to examine the revocation windows for GCP after Eduard Agavriloae, co-founder of Offensai, published research late last year on revocation delays in AWS credentials. But as Leon noted in his blog post, those delays were just four seconds, and AWS responded to the issue.

"Four seconds was enough to matter on AWS," he wrote.

The revocation windows for Google's API keys were, by comparison, exponentially longer. Aikido's research team ran 10 tests over two days where they created virtual machines (VMs) in different GCP regions, deleted the API keys, and sent up to five authenticated requests per second to see how long the keys worked after the deletion.

The test results were "highly unpredictable," as one trial had a 79% authentication success rate after one minute, while another test had just a 5% success rate. Additionally, Aikido's research team found success rates were significantly different based on the VM's region.

For example, according to the test results, VMs in GCP's asia-southeast1 had a median request authentication success rate of just 22% after one minute, while the success rates of us-east1 and europe-west1 regions were 49%. Leon noted that VMs farther away from the US picked up deletion requests faster, which "is the opposite of what you'd expect," though it's unclear why.

"Google's request routing is more complex than 'VM region equals server region'" and a VM in Singapore isn't necessarily talking to servers in Singapore," Leon wrote. "But the pattern was consistent across trials, which points to something regional infrastructure, caching, or routing affinity driving the difference."

Whatever the cause, Leon says the regional differences are "entirely driven by where the researcher (or attacker) originated their requests," and are independent of the customer's geographic location.

Aikido's report stated that GCP's user interface (UI) for key deletions states, "Once deleted, it can no longer be used to make API requests." Leon wrote that the UI is demonstrably false and leaves customers in the dark when an API key is fully revoked.

Leon tells Dark Reading the revocation windows for Google's API keys, as well as the unpredictable authentication success rates, complicate matters for incident response teams that are dealing with a potential breach.

"This breaks the mental model IR teams have when responding to leaked credentials," he says. "It's assumed that when you click 'Delete' or 'Revoke' that the credential no longer works. Now IR teams need to remember that for GCP credentials, a window exists when that 'Deleted' credential still works for attackers."

To that end, Aikido recommended that security teams and IR personnel use a 30-minute window for Google API key deletions. Additionally, organizations should monitor their API requests by credential through the "Enabled APIs and services" portion of the GCP console, and review API requests by credential. "If you see unexpected usage from that credential after deletion, someone could be actively exploiting it," Leon wrote.

Aikido reported the findings to Google, but the company closed the report as "won't fix," according to the blog post. Dark Reading contacted Google for on the research, but the company did not respond at press time.

Leon noted that Google has faster revocations for other types of credentials, as service account deletions propagate across the platform in five seconds and Gemini's newer API key format is fully revoked in approximately one minute. This suggests that it's "technically solvable" to reduce the revocation windows for Google API keys.

"Distributed systems at Google's scale are hard, and this is not a critique of the GCP IAM team," Leon wrote. "But a 23-minute revocation window is fundamentally at odds with what users expect from a delete button."

Senior News Director, Dark Reading

Rob Wright is a longtime reporter with more than 25 years of experience as a technology journalist. Prior to joining Dark Reading as senior news director, he spent more than a decade at TechTarget's SearchSecurity in various roles, including senior news director, executive editor and editorial director. Before that, he worked for several years at CRN, Tom's Hardware Guide, and VARBusiness Magazine covering a variety of technology beats and trends. Prior to becoming a technology journalist in 2000, he worked as a weekly and daily newspaper reporter in Virginia, where he won three Virginia Press Association awards in 1998 and 1999. He graduated from the University of Richmond in 1997 with a degree in journalism and English. A native of Massachusetts, he lives in the Boston area.

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

How Enterprises Are Harnessing Emerging Technologies in Cybersecurity

Ditch the Data Center: Understanding Flexible Cloud Infrastructure Security Management

Building SecOps That Make the Most of Every Dollar

AI-Powered Credential Security: Intelligence Without Exposure

AI-Powered Cybersecurity for Resource-Constrained Organizations

How Security Teams should apply Threat Intelligence into their Defenses

Your Guide to Securing AI Adoption in Your Organization