Google API Keys May Work Up to 23 Minutes After Deletion

Security researchers have discovered that Google API keys can remain active and capable of authenticating requests for up to 23 minutes after a user deletes them in the Google Cloud Platform console. This delay creates a significant window during which an attacker with a stolen key could continue to access services and data.

The findings, based on testing conducted by the cybersecurity firm Aikido Security, indicate a median revocation window of approximately 16 minutes. In a series of ten trials performed over two days, researchers created and deleted API keys while sending authenticated requests. They found the keys continued to work for varying periods, with the longest observed window lasting 23 minutes. The success rate of requests after deletion was also highly unpredictable, ranging from 5 percent to 79 percent one minute after deletion in different tests.

Researchers attribute the delay to the eventual consistency model of Google's distributed authentication infrastructure. In this system, updates like a key deletion propagate gradually across global servers rather than instantaneously. This means a deleted key may still work on servers that have not yet received the...