Deleted Google API keys authenticate for 23 minutes

Authentication should never be eventually consistent, and a 23-minute revocation window for critical APIs is a dangerous architectural compromise.

• –Stolen keys can still be exploited to dump uploaded files or exfiltrate cached conversations after deletion
• –Revocation propagates unevenly across Google's infrastructure, with access decaying unpredictably rather than cutting off
• –The GCP console "Traffic by Credential" graph lumps all deleted key traffic into a confusing `apikey:UNKNOWN` bucket, hindering incident response
• –Google Service Account keys and new Gemini API keys revoke in under a minute, highlighting that this is a specific flaw in standard API keys
• –Google considers this a known system property rather than a security bug, leaving developers responsible for the exposure window