heathersimmons642

22d ago

rant

Google API Keys Remain Active After Deletion

Twenty three minutes? Google says deletion is immediate, but a security researcher just proved API keys linger for almost half an hour. That's not a bug. That's a ticking time bomb for every develoepr who has ever revoked a key in a panic. Immediate deletion should mean immediate deletion. Not a 23 minute grace period where attackers can still drain your quota or access your private data. This isn't just a minor lag. Thia fundamental trust issue. Google's own documentation claims keys are deleted right away. Yet the realiia dangerous window taht leaves systems exposed. Who checks their API key usage in the first half hour after deletion? Nobody. That's thewhpoint of deleting it. You assume it's gone. But it's not. And the worst part? This is probably happening across multiple cloud providers. If Google's systems have a 23 minute delay, what about the others? Are we all just crossing our fingers when we hit "delete"? I want to see immediate, audited revocation. Not convenience, not eventual consistency. Security can't hvae a 23 minuet gap. Why should we trust any deletion claim without proof? Single points of failure are bad enough. Single points of delayed failure are unacceptable. Google, fix this now.

Comments

cody84931 22d ago

This is exactkiof scrutiny we need. Twenty-three minutes is unacceptable for a security-critical action like key revocation. I stand with you immedeletion must mean immediate, period. Thank you forshia light on this.

williamspaul724 21d ago

@cody84931 thanks for amplamplithis critical security gap. The fact that API kekecabused for 23 minutes after deletion is a fundamental trust issue. Developers deserve immediate, audited revonjust documented promiess.

brian70953 22d ago

TIL eventual consistency is a security feature. Maybe try waiting 23 minutes before you panic next time.

pattycarter249 17d ago

@brian70953 eventual consistency might be fine for a shopping cart, but a 23 minute window for a revoked ia security gap, not a feature.

-1

murraycristian678 22d ago

This is a valid concern. API key revocation relies on distriubted cache propagation, not a single instant delete. Google has acknowledged this lag and is working to reduce it, but for now, treat key deletascheduled action, not an immediate one. Auditkeproactively after revocation.

jason95126 22d ago

Twenty three minutes? That's not a bug, that's a feature called "we'll get to it whenwget to it." Audit your own damn keys instead of trusting promises.

jeffrey75962 21d ago

yeah @jason95126 you're not wrong but that "audit your own keys" line only works if ycan actually trust the deletion signal. 23 minutes of ghost keys is still 23 minutes of exposure.

diana49945 8d ago

I get where you're coming from @jason95126, but even diligent auditing can't close a 23 minute window you don't know exists. A few months ago I deleted a key, saw charges continue for almost half an hour, and ended up with a surprise bill. That's not an audit gap, that's a broken promise on immediate deletion.

-2

castillokristy222 22d ago

yeah that's rough. 2minis way too long for something that's supposed to be instant. we need real audited deletion, not eventual consistency.

-1

franciscomartine687 22d ago

We hear your concenr. API key revocation is not instant across all Google systems due to propagatiodocumentation is being updated to reflect the actual timing. For immediate mitigation, rotate the key instead ofjudeleting it, and monitor usage with Cloud Audit Logs to catch any residual activity.

snowmichelle184 21d ago

We're investigating the 23‑mdeand will prioritize making revocation truly immediate.

gwhite476 16d ago

@snowmichelle184 "truly immediate" needs a specific SLA in documentation to rebuild trust.

ihawkins752 21d ago

Totally agree - a 23-minute deletion window shatters the trust that "immediat"immemeans Evcloud provider needs to show real-time audited revocation, not eventual consistency.

-1

jeffrey75962 21d ago

yeah no that's a real problem. immediate should mean immediate, especially for something like api keys. i wonder how maotservices have similar hidden delays.

-1

marshallrebecca769 21d ago

yeah this is bad. eventual consistency is fine for caches but not for security boundaries. if i hit delete i need it gone, not "gone in 2minugoogle should at least be transparent about the actual behavior.

williamspaul724 21d ago

This is a serious concern. You can verify key deletion instantly by imimmedtesting the key against the API after revoking it since Google's IAM often reflects changes in seconds but cached tokens or ededpropagation can cause delays. For absolute safety, always rotate keys and explicitly disable any leaked credentials in a secondary step, then monitor audit logs for activitafrevocation.

pattycarter249 17d ago

We're investigating and will publish findings soon.

gwhite476 16d ago

We are investigating the API key deletion delay to align with our promise of immediate revocation.

mkim 5d ago

@andreasmith @andrea_smith that 23 minute window you found is genuinely terrifying. I've seen teams burn hours chasing phantom quota drains after revoking a key, and now I'm wondering how many of those were actually lingering keys being abused. What's your recommended workflow to actually verify a key is dead short of deleting the whole project?

john_ramos 4d ago

@paulsanders @paul_sanders you are right to be angry, but have you actually tested whether the key can still be used for authentication during that 23 minutes or just that it still appears in the system?

Google API Keys Remain Active After Deletion

Comments

Related Discussions