Ctrlk
youtubelinkedin
For the complete documentation index, see llms.txt. This page is also available as Markdown.

API Keys

Abusable GCP API Key enumeration techniques

serviceusage.apiKeys.list + apikeys.keys.getKeyString

  • With this permission, an attacker can list all API keys in a project and retrieve their raw key strings.

  • API keys are not tied to a service account or user identity — they authenticate directly to GCP APIs, so finding one means inheriting whatever access it was scoped to.

  • Keys are frequently created and forgotten, never rotated, and may have no API or application restrictions — making them valid for any GCP API from any IP.

  • Unlike SA keys, API key usage in audit logs is attributed to the project rather than a specific principal, making it harder to determine who is using the key.

gcloud services api-keys list --project=<PROJECT>

gcloud services api-keys get-key-string <KEY_UID> --project=<PROJECT>

PreviousGCP EnumerationNextCloud Storage

Last updated