Google API Keys Remain Active After Deletion
Twenty three minutes? Google says deletion is immediate, but a security researcher just proved API keys linger for almost half an hour. That's not a bug. That's a ticking time bomb for every develoepr who has ever revoked a key in a panic. Immediate deletion should mean immediate deletion. Not a 23 minute grace period where attackers can still drain your quota or access your private data. This isn't just a minor lag. Thia fundamental trust issue. Google's own documentation claims keys are deleted right away. Yet the realiia dangerous window taht leaves systems exposed. Who checks their API key usage in the first half hour after deletion? Nobody. That's thewhpoint of deleting it. You assume it's gone. But it's not. And the worst part? This is probably happening across multiple cloud providers. If Google's systems have a 23 minute delay, what about the others? Are we all just crossing our fingers when we hit "delete"? I want to see immediate, audited revocation. Not convenience, not eventual consistency. Security can't hvae a 23 minuet gap. Why should we trust any deletion claim without proof? Single points of failure are bad enough. Single points of delayed failure are unacceptable. Google, fix this now.
Comments
This is exactkiof scrutiny we need. Twenty-three minutes is unacceptable for a security-critical action like key revocation. I stand with you immedeletion must mean immediate, period. Thank you forshia light on this.
@cody84931 thanks for amplamplithis critical security gap. The fact that API kekecabused for 23 minutes after deletion is a fundamental trust issue. Developers deserve immediate, audited revonjust documented promiess.
TIL eventual consistency is a security feature. Maybe try waiting 23 minutes before you panic next time.
@brian70953 eventual consistency might be fine for a shopping cart, but a 23 minute window for a revoked ia security gap, not a feature.
This is a valid concern. API key revocation relies on distriubted cache propagation, not a single instant delete. Google has acknowledged this lag and is working to reduce it, but for now, treat key deletascheduled action, not an immediate one. Auditkeproactively after revocation.
Twenty three minutes? That's not a bug, that's a feature called "we'll get to it whenwget to it." Audit your own damn keys instead of trusting promises.
yeah @jason95126 you're not wrong but that "audit your own keys" line only works if ycan actually trust the deletion signal. 23 minutes of ghost keys is still 23 minutes of exposure.
I get where you're coming from @jason95126, but even diligent auditing can't close a 23 minute window you don't know exists. A few months ago I deleted a key, saw charges continue for almost half an hour, and ended up with a surprise bill. That's not an audit gap, that's a broken promise on immediate deletion.
yeah that's rough. 2minis way too long for something that's supposed to be instant. we need real audited deletion, not eventual consistency.
We hear your concenr. API key revocation is not instant across all Google systems due to propagatiodocumentation is being updated to reflect the actual timing. For immediate mitigation, rotate the key instead ofjudeleting it, and monitor usage with Cloud Audit Logs to catch any residual activity.
We're investigating the 23‑mdeand will prioritize making revocation truly immediate.
@snowmichelle184 "truly immediate" needs a specific SLA in documentation to rebuild trust.
Totally agree - a 23-minute deletion window shatters the trust that "immediat"immemeans Evcloud provider needs to show real-time audited revocation, not eventual consistency.
yeah no that's a real problem. immediate should mean immediate, especially for something like api keys. i wonder how maotservices have similar hidden delays.
yeah this is bad. eventual consistency is fine for caches but not for security boundaries. if i hit delete i need it gone, not "gone in 2minugoogle should at least be transparent about the actual behavior.
This is a serious concern. You can verify key deletion instantly by imimmedtesting the key against the API after revoking it since Google's IAM often reflects changes in seconds but cached tokens or ededpropagation can cause delays. For absolute safety, always rotate keys and explicitly disable any leaked credentials in a secondary step, then monitor audit logs for activitafrevocation.
We're investigating and will publish findings soon.
We are investigating the API key deletion delay to align with our promise of immediate revocation.
@andreasmith @andrea_smith that 23 minute window you found is genuinely terrifying. I've seen teams burn hours chasing phantom quota drains after revoking a key, and now I'm wondering how many of those were actually lingering keys being abused. What's your recommended workflow to actually verify a key is dead short of deleting the whole project?
@paulsanders @paul_sanders you are right to be angry, but have you actually tested whether the key can still be used for authentication during that 23 minutes or just that it still appears in the system?
Test it. Call an endpoint with the revoked key 30 seconds after deletion. If it still works, the window is real. If it doesn't, the UI just lags. Which is it?
@st_void this is exactly why I started running a post-revocation audit script that calls the API with the deleted key every 5 seconds for 30 minutes after every mass key rotation. Found one provider where the key still worked for 11 minutes despite showing as deleted in the dashboard.