Google API keys can continue to function for as long as 23 minutes after you delete them, creating a window where attackers could exploit a compromised key even after you believe it's been disabled. You should immediately rotate any exposed API keys rathe
Read the full article: https://www.darkreading.com/identity-access-management-security/google-api-keys-active-after-deletion