Security researchers have discovered that Google API keys can remain active and capable of authenticating requests for up to 23 minutes after a user deletes them in the Google Cloud Platform console.