Google APIs Keys Keep Working After You Delete Them

2026-05-27

Researchers from Aikido security discovered that Google API key deletion is eventually consistent and can take up to 23 minutes to fully propagate. Gemini API keys and Google Service Account keys propagated in one minute and 5 seconds, respectively. Google initially closed the bug report as “won't fix” but reopened it as a P0 after the researchers published their findings.