Perhaps you can start with telling us where in cloud console you have searched and failed ? More on reddit.com

Leonid - credit where it's due: the hygiene guidance is correct. API and application restrictions, Secret Manager, no hardcoding, rotation, audits - developers should do all of it, and after the fraud wave hit me, I did too. But the sentence your post is built on - "Securing API keys is a user's responsibility" - is contradicted by your own article. I know you are expecting a technical feedback but I could not hold back after reading your concluding line. Reactive education is welcome. But ending it with "it's the user's responsibility" converts a useful how-to into a liability disclaimer - published, notably, days after this fraud wave hit and the trade press. So here's the honest conclusion: this is shared. Mine - to restrict, store, and rotate keys properly. Google's - to make the safe path the default, to cap the blast radius, to act on the real-time abuse signal it already collects, and to stop retroactively widening what a key can reach. This isn't theoretical for me. Five days before your post, a leaked key ran ~$80,000 of Gemini image generation through my project in about 8 hours - from a $15/day baseline to $16000 in a single hour. Google's systems watched it happen; I had to disable the API myself. That API was created in January in AI Studio to evaluate Gemini models. Who knew the api key created is not a secret!!! There was no disclaimer!! You write not to create unrestricted keys." You also write "by default a new API key is created without restriction." Google ships the exact configuration you tell us never to use, as the default - then files the damage under "user responsibility." A platform that makes the unsafe choice the default owns a share of every outcome that default produces. If the credential is, by Google's own description, not actually secret, then the controls that bound the damage cannot sit entirely with the user. They have to sit in the platform. More on reddit.com

If it is a company card/bank account just declare bankruptcy, close the company, and tell them tough luck. Try again in a month or two. More on reddit.com

I've found the answer (a kind of) in the Google help . There is a report that looks like: More on reddit.com