Deleting an API key in Google Cloud Platform (GCP) does not instantly terminate its access. Recent security research indicates a delay—sometimes up to 23 minutes—between a user deleting a key and its final revocation across Google’s distributed infrastructure. This eventual consistency creates a temporary window where revoked credentials can still authenticate requests.
The finding comes from Joe Leon, a researcher at Aikido Security. His work builds on prior research by Eduard Agavriloae of Offensai, who documented a four-second consistency delay for AWS credentials last year. While a four-second window requires highly automated timing to leverage, the GCP API key delay presents a more accessible window for unauthorized access.
Measuring the eventual consistency gap
To measure the exact revocation window, the Aikido research team ran 10 trials over two days. They generated API keys, immediately deleted them, and sent up to five authenticated requests per second from virtual machines (VMs) in different GCP regions. The data showed a median revocation window of 16 minutes and a maximum delay of nearly 23 minutes.
The decay in access was unpredictable and varied significantly by geographic region. One minute after deletion, testing from the asia-southeast1 region showed a 22% authentication success rate. In contrast, requests from us-east1 and europe-west1 succeeded at a rate of roughly 49%. Paradoxically, VMs located further from the United States synchronized the deletion request faster, though the exact routing and caching mechanisms causing this regional difference remain opaque.
This extended delay appears specific to standard GCP API keys. The testing showed that GCP Service Account key deletions propagate much faster, completing in approximately five seconds. Additionally, the newer Gemini API key format (which uses an AQ. prefix) fully revokes in about one minute.
Adjusting incident response procedures
This propagation delay complicates incident response workflows. The GCP console interface states that once a key is deleted, it can no longer be used to make API requests. Because security teams naturally assume the credential is dead immediately upon deletion, this behavior breaks the standard mental model for responders managing compromised credentials. During the 23-minute window, an unauthorized party could continue to interact with enabled APIs, which could result in the exposure of uploaded files or cached Gemini conversations.
Further complicating response efforts, GCP bundles rejected requests from deleted keys into a generic apikey:UNKNOWN category within the "Traffic by Credential" graph. Because all deleted keys filter into this same reporting bucket, responders cannot easily differentiate between a malicious actor attempting to use a newly revoked credential and background noise from older, unrelated services.
Aikido reported the findings to Google, which closed the disclosure as "won't fix." The company views the propagation delay as a known architectural property of its eventual consistency model rather than a security defect.
To protect cloud environments, security teams should assume a 30-minute consistency window when revoking GCP API keys. During this period, organizations should actively monitor the "Enabled APIs and services" dashboard for successful authentications tied to the specific credential. Any valid requests after deletion indicate the key is still active and potentially in use by an unauthorized party, requiring continued monitoring until the infrastructure fully synchronizes.