Researchers confirm leaked Google API keys may remain usable for about 23 minutes after deletion

Aikido reported that deleted Google API keys can keep working for minutes after revocation because removal propagates gradually across Google’s infrastructure.

Tests found a median delay of about 16 minutes and a maximum of roughly 23 minutes before the keys fully stopped authenticating.

That creates a security window where leaked keys could still be used to access services, exfiltrate data, or generate charges.

The report says Google closed the issue without fixing it.