A security researcher discovered the API keys can still be used for up to 23 minutes after deletion, even though the cloud provider claims deletion is immediate.
Google API Keys Remain Active After Deletion
Summary + source link. No paywalls, no tracking.