Google Cloud API keys may continue functioning for up to 23 minutes after deletion, exposing a significant security gap that could allow attackers to retain unauthorized access to cloud services even after credentials are revoked.
Google API Deleted Keys to Retain Access
Security researchers from Aikido, led by Joe Leon, discovered that deleted Google API keys do not immediately lose access as expected. Instead, revocation propagates gradually across Google’s distributed infrastructure, creating a “revocation window” during which the key remains intermittently valid.
In testing across 10 trials, researchers observed:
- Maximum revocation delay of approximately 23 minutes
- Minimum delay of around 8 minutes
- Median revocation time of roughly 16 minutes
During this window, authentication behavior was inconsistent. Some requests failed instantly, while others continued to succeed depending on which backend servers processed them. This inconsistency allows attackers with a leaked API key to continue making requests until all systems fully recognize the deletion.
If a Google API key tied to services like Gemini or BigQuery is exposed, an attacker could:
- Continue sending API requests after the key is deleted
- Access sensitive data, such as stored files or AI interaction history
- Exploit uneven revocation across regions to prolong access
For instance, even 10 minutes after deletion, a subset of requests may still succeed if routed through lagging infrastructure nodes.
The research also revealed notable regional differences in revocation behavior. Tests conducted across Google Cloud regions (us-east1, europe-west1, asia-southeast1) showed varying success rates immediately after deletion.
In some cases, systems farther from the U.S. revoked faster than those closer to the U.S., suggesting that internal routing, caching, or infrastructure design influences how quickly deletions propagate.
Additionally, GCP logs group requests made with deleted keys under a generic “apikey:UNKNOWN” label. This complicates incident response, as security teams cannot easily attribute activity to a specific compromised key once it has been deleted.
Not all Google credentials exhibit this delay. The researchers found:
- Service account keys are revoked in approximately 5 seconds
- New Gemini API keys (AQ-prefixed) revoke in about 1 minute
- Legacy Google API keys take up to 23 minutes
This disparity indicates that faster revocation is technically feasible but not implemented uniformly across credential types.
Google reportedly classified the issue as “won’t fix,” citing eventual consistency as a known architectural characteristic rather than a vulnerability. While eventual consistency helps large-scale systems remain performant, applying it to authentication introduces exploitable timing gaps.
The issue also raises concerns about misleading user expectations. The Google Cloud console states that deleted keys can no longer be used, yet provides no visibility into revocation status or confirmation of when access fully terminates.
Mitigation Recommendations
Until changes are implemented, organizations using Google API keys should adjust their security practices:
- Treat API key deletion as a delayed process, assuming up to 30 minutes of continued exposure
- Monitor API usage closely after deletion for signs of unauthorized activity
- Avoid relying solely on deletion during incident response; rotate and restrict keys proactively
- Prefer more secure credential types, such as service accounts, where possible
This finding highlights a broader security challenge in distributed systems: while eventual consistency improves scalability, it may conflict with the strict immediacy required for credential revocation.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
