> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/gcp/gcp-offensive-security/gcp-privilege-escalation/api-keys.md).

# API Keys

## Overview

* API keys can be created in a project with no API restrictions and no application restrictions which means leaked keys or an attacker creating a key introduces a risk.
* Not all services e.g., IAM, Secret Manager, or BigQuery support API key-based auth.

***

## serviceusage.apiKeys.create

* With this permission, an attacker can create a new API key in the project with no API restrictions and no application restrictions.

{% code overflow="wrap" %}

```shellscript
gcloud services api-keys create --display-name="<NAME>" --project=<PROJECT>
```

{% endcode %}

***

## apikeys.keys.getKeyString

* With this permission, an attacker can retrieve the API key value
* Note — you need the key's `name` not its `displayName`

{% code overflow="wrap" %}

```shellscript
## Return key name
gcloud services api-keys list

## Return API key credential
gcloud services api-keys get-key-string projects/<Project-Id>/locations/global/keys/<KEY-NAME>
```

{% endcode %}

***