Google API keys keep working after you delete them

A significant logic and caching flaw within Google's cloud management infrastructure leaves systems highly exposed to unauthorized access. Security researchers discovered that deleting a Google API key from the administrative console does not revoke its functionality immediately. Instead, deleted keys remain fully capable of successfully authenticating requests for up to 23 minutes after deletion. Google has reportedly declined to apply an immediate fix for this architectural behavior. This time delay creates a perilous window of vulnerability; if a key is compromised and an administrator deletes it to stop an ongoing attack, the adversary retains access to cloud services, data storage repositories, and internal resources for nearly half an hour, allowing continued data exfiltration or system modification.Since a definitive vendor-side fix is currently unavailable, organizations cannot rely solely on deleting an API key during an active incident. Instead, security operations teams must immediately modify the key's internal access restrictions—such as limiting IP addresses or disabling specific API service permissions—prior to deleting the key entirely, which instantly restricts its utility. Security teams should also monitor cloud access logs for at least 30 minutes following any key deprecation to detect post-deletion authentication attempts.If you need expert assistance in identifying compromised packages, securing your CI/CD pipelines, or conducting an emergency supply chain audit, contact Cyberlinx today to protect your development environment.