“You have no way to revoke it faster or confirm when it stops working”: Experts find that Google API keys are still usable, even after deleting them

Aikido Researchers Find Google API Keys Remain Usable Up to 23 Minutes After Deletion
Success rates varied across trials, with Gemini-enabled projects particularly vulnerable to stolen files and cached conversations.
Google dismisses the issue as a delay in propagation, but Aikido advises treating the deletion as a 30-minute window and monitoring for unexpected usage.

If, when you delete a Google API key, you expect it to no longer work – effective immediately – we have a surprise for you.

Researchers at Aikido found that users can successfully authenticate up to 23 minutes after deletion, creating a gigantic security risk and a major opportunity for bad actors.

The worst part is that users have virtually no way of knowing when the authentication window closes and can do absolutely nothing to speed it up.

“False statements”

In its report, Aikido describes running 10 trials over two days, creating and deleting API keys while sending 3-5 authenticated requests per second, to measure the revocation window.

What they found was rather inconsistent: the longest window was 23 minutes, while the shortest was 8 minutes.

The team also said that success rates were very unpredictable, as one trial saw 79% of requests succeed one minute after deletion, while another only 5%. The problem is even worse for projects in which Gemini is activated, Aikido further emphasized. Malicious actors can delete downloaded files and exfiltrate cached conversations using the “deleted” key with relative ease.

The report criticized Google for its misleading user interface, which tells users who have deleted their keys “Once deleted, they can no longer be used to make API requests.”

“This statement is patently false,” Aikido said. “The user has no way of knowing if the key is still active, no way to expedite revocation, and no way to confirm when it has completely stopped working.”

Google responded to the Aikido disclosure by closing the report and saying it would not fix the problem. “The team’s position, as we understand it, is that propagation delay is a known property of the system and not a security issue,” the report said.

There may not be a fix or workaround, but Aikido discusses mitigation. Key deletion should be treated as a 30-minute operation, and during this window, users should monitor the “Enabled APIs and Services” in the GCP console for any unexpected usage of the deleted credential.