Google API keys keep working after you delete them

[Khushal]

Content source

https://www.aikido.dev/blog/google-api-keys-deletion

tl;dr When you delete a Google API key, it says it’s immediately deleted. Our testing says ~23 minutes. During that window, an attacker with a leaked key keeps access to your data and enabled APIs (including Gemini). You have no way to revoke it faster or confirm when it stops working. Google closed our report as “won’t fix”.

Google API keys keep working after you delete them long enough to be exploited

Deleting a Google API key doesn't revoke it immediately. Our testing found successful authentications up to 23 minutes after deletion, and Google has declined to fix it.

www.aikido.dev

 

[Wrecker4923]

This is similar to Microsoft Authenticator continuing to authenticate access (forever?) to your Microsoft account even after a password change, or Google not logging you out of Android immediately (sometimes up to ~5 minutes) after you remove a device from your account. Cross-device authentication is convenient, but it can complicate account recovery if someone takes over your accounts. It's better to not lose control of those ecosystem accounts in the first place.