Check ID: apikeys_key_exists
Provider: GCP
Service: apikeys
Severity: MEDIUM
Categories: secrets
Resource type: apikeys.googleapis.com/Key

​
What this check verifies

Google Cloud projects are evaluated for active API keys. The finding indicates whether any keys exist and are enabled in the project, regardless of restrictions or usage.

​
Risk

Active API keys are bearer tokens often exposed in clients and lack user identity. Compromise enables unauthorized API calls causing data exposure (C), unauthorized changes (I), quota/service exhaustion (A), and billing abuse. Keys can be harvested from code, logs, or intercepted requests.

​
Recommendation

Prefer service accounts with short-lived credentials or OAuth 2.0, enforcing least privilege. If keys are necessary, restrict by API and application, store them in a secrets manager, rotate and revoke promptly, monitor with alerts as defense in depth, and remove unused keys.

​
Remediation

Dashboard steps
  1. In the Google Cloud Console, go to APIs & Services > Credentials
  2. In the API keys section, for each key with state Active, click its row > Delete > Confirm
  3. Repeat until no API keys remain in the project
  4. Refresh the page to verify the API keys list is empty

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = apikeys_key_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks