Google Cloud API keys remain functional for approximately 23 minutes after deletion, directly contradicting Google’s documented practice of immediate revocation. This gap eliminates key deletion as a reliable containment action during incident response, an attacker holding a compromised key retains live access through the entire post-deletion window. The finding signals a broader risk: when cloud provider SLAs around credential revocation cannot be trusted, incident response playbooks built on those guarantees require revision to account for the documented delay.