Google API keys keep working after you delete them

What it is

Aikido's measurement of Google Cloud API key revocation lag, with specific incident-response guidance for teams handling a leaked GCP API key. The summary covers the ~23-minute window and the apikey:UNKNOWN bucket; what it omits is what an IR analyst should actually look for and the concrete impact if Gemini is enabled.

How it works

Revocation propagates gradually across Google's authentication servers. There is no clean cutoff and no predictable decay — access "keeps working, unevenly, until it eventually just stops." The unpredictability is stark: one minute after deletion, one trial saw 79% of requests still succeed while another saw only 5%. You cannot force revocation faster, and the console gives you no signal for when the key actually stops working.

If Gemini is enabled on the project, an attacker inside the window can dump files you have uploaded and exfiltrate cached conversations — not just abuse the API quota.

What to do

The page's concrete IR triage rule, keyed to the ~23-minute window:

• Inside the window (first ~23 min after deletion): hunt for valid (successful) authentications made with the leaked key. These are live attacker activity.
• Outside the window: the residual risk "appears extremely low" — deprioritize.

Do not rely on the "Traffic by Credential" graph to attribute activity to a specific deleted key. Every request from any deleted key — including keys deleted days earlier — is bundled into the single apikey:UNKNOWN group. A hit there could be a threat actor retrying the stolen key, or a legitimate service still running on an unrelated stale key. Treat the bucket as ambiguous, not as evidence tied to your credential.

Caveats

• Aikido throttled to 3–5 requests/second to respect Google's infrastructure and explicitly states this "may not represent the worst case" — an unthrottled attacker rotating through more servers could see a longer window. They can't say whether a higher rate extends it.
• Numbers come from 10 trials over two days, spot-checked weeks later; they are measurements, not a guaranteed maximum.
• The apikey:UNKNOWN attribution behavior is Aikido's "best guess" (Google may preserve project attribution to allow credential restoration), not confirmed by Google.
• Regional propagation was counterintuitive — VMs further from the US (asia-southeast1) sometimes picked up the deletion faster than us-east1 — and the authors say they can't explain the routing from the outside. Don't assume geographic proximity predicts revocation speed.

For precedent: the post cites Eduard Agavriloae's disclosure of a 4-second AWS access-key revocation delay that was enough to create new credentials — the point being that even seconds matter, so 8–23 minutes is a large exposure.