> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/gcp/gcp-offensive-security/gcp-enumeration/api-keys.md).

# API Keys

## serviceusage.apiKeys.list + apikeys.keys.getKeyString

* With this permission, an attacker can list all API keys in a project and retrieve their raw key strings.
* API keys are not tied to a service account or user identity — they authenticate directly to GCP APIs, so finding one means inheriting whatever access it was scoped to.
* Keys are frequently created and forgotten, never rotated, and may have no API or application restrictions — making them valid for any GCP API from any IP.
* Unlike SA keys, API key usage in audit logs is attributed to the project rather than a specific principal, making it harder to determine who is using the key.

{% code overflow="wrap" %}

```shellscript
gcloud services api-keys list --project=<PROJECT>

gcloud services api-keys get-key-string <KEY_UID> --project=<PROJECT>
```

{% endcode %}

***