TLDR Tech / IT
Deleting a Google API Key Doesn't Revoke It for Up to 23 Minutes
Security researchers found that deleted Google API keys can continue working for up to 23 minutes, creating a dangerous revocation window where attackers can still make API calls, access enabled services, or rack up charges. Until Google changes this behavior, teams should rotate or disable exposed keys immediately and treat deletion as a delayed cleanup step rather than an instant kill switch.
Read the full story