'You have no way to revoke it faster or confirm when it stops working': Experts find Google API keys are still usable, even after you delete them
Aikido researchers have discovered that Google API keys can remain active for up to 23 minutes after deletion, posing a significant security risk. The inconsistency in the revocation window and the potential for unauthorized access raises concerns for users, especially those utilizing Gemini-enabled projects. Google has dismissed the issue as a propagation delay, but experts recommend treating the deletion process with caution and monitoring for unexpected usage.
- ▪Google API keys can still be authenticated for up to 23 minutes after deletion.
- ▪The revocation window varies significantly, with success rates fluctuating across trials.
- ▪Aikido's report criticized Google's misleading user interface regarding the immediate effectiveness of key deletion.
Opening excerpt (first ~120 words) tap to expand
Pro Security 'You have no way to revoke it faster or confirm when it stops working': Experts find Google API keys are still usable, even after you delete them News By Sead Fadilpašić published 22 May 2026 Some Google API keys can still be used For more than 20 minutes after deletion When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. (Image credit: Quardia via Shutterstock) Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Aikido researchers find Google API keys remain usable for up to 23 minutes after deletionSuccess rates varied across trials, with Gemini‑enabled projects especially…
Excerpt limited to ~120 words for fair-use compliance. The full article is at TechRadar.
Discussion
0 commentsMore from TechRadar
