A security study has identified that Google API keys can remain active for up to 23 minutes after deletion, potentially creating a window of vulnerability for unauthorized access. The research highlights a timing gap between when users delete API keys and when Google’s systems fully deactivate them across all services.