What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Find credentials that look inactive, verify whether anything still depends on them, then disable or revoke them before deleting them. A missing “last used” timestamp or a long quiet period is a reason to investigate—not proof that a key or token is safe to remove. Start with provider inventories and activity logs, confirm the owner and replacement path, and monitor after each change.
What counts as an unused credential?
“API key” and “OAuth token” cover several different things. An API key may belong to a person, service account, application, or SaaS integration. OAuth involves an application client and may also involve user-granted access, access tokens, refresh tokens, and client secrets. These objects have different owners and different revocation effects, so identify exactly which credential you are reviewing before changing it.
As an Amazon Associate I earn from qualifying purchases.
A credential can appear inactive because its workload runs only during a reporting cycle, seasonal period, or disaster-recovery event. It can also be absent from a dashboard because that data source does not record the relevant credential type or has incomplete history. Treat inactivity as a screening signal and assess it against the application’s real operating cycle.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Build an inventory before making changes
Set the scope first: list the cloud accounts, projects, tenants, organizations, repositories, and SaaS services you need to review. Do not assume one console contains every credential. Include human IAM keys, service-account keys, machine identities, application registrations and secrets, API keys issued by SaaS services, OAuth grants, and access or refresh tokens where the provider exposes them.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For each credential, record its identifier—not its secret value—and the information needed to make a safe decision:
- Provider, account or tenant, and credential type.
- Accountable owner, application or workload, and environment.
- Permissions or OAuth scopes, plus the systems that can use it.
- Creation and expiry dates, if available.
- Last-use signal, timestamp, and the source that reported it.
- Whether a replacement is deployed, and the proposed action.
Keep secret material out of the inventory. Store credentials in an appropriate secure system, not in an audit spreadsheet or ticket. Google for Developers’ OAuth best practices advise securely storing client credentials and user tokens, and revoking and deleting tokens when they are no longer needed.
Find activity—and record what the data cannot tell you
Use provider-native reports, usage metrics, and audit logs rather than relying on credential age alone. Check that the source covers the account, application, credential type, and time period you need. A parent application’s activity does not necessarily establish that a particular key or token was used.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Provider feature | What it can tell you | Important qualification |
|---|---|---|
| AWS credential reports and IAM Access Analyzer; CloudWatch alarms and GuardDuty for monitoring | AWS recommends these as parts of credential review and monitoring. | Available provider documentation does not establish a single activity lookback period or a universal last-used signal for every credential type. Confirm the report and log coverage in your account. |
| Google Cloud service-account insights and Key Authentication Events metric | Service-account insights identify accounts unused in the past 90 days; Key Authentication Events can show when and how often a key authenticated. | The 90-day window is specific to this Google Cloud insight, not a general definition of “unused.” Check whether the metric is available for the specific key and workload. |
| Microsoft App Governance | Can expose last-used and credential-unused information and supports filtering and export. | Some records show only “Over 30 days ago” or “Not available,” so the signal may be coarse or absent rather than precise. |
Preserve those limitations in your inventory. If a dashboard has no timestamp, do not mark the credential unused on that basis alone. For an infrequent job, compare the observation window with its business cycle and include recovery or non-production checks where practical.
How long without activity is long enough?
There is no universal inactivity period that proves a credential is safe to retire. A monthly report, annual process, seasonal integration, or disaster-recovery path can legitimately remain quiet for long stretches. Choose a local review window based on the workload’s schedule, business impact, logging coverage, and the cost of an outage.
Keep vendor thresholds in context. Google Cloud’s service-account insight uses a past-90-days window. Separately, Google’s OAuth-client policy describes automatic deletion after six months of inactivity, with notification 30 days before scheduled deletion. Google recommends proactively deleting unneeded clients rather than relying on that policy. These are product-specific rules, not interchangeable standards for all API keys or OAuth tokens.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
AWS’s 2025 Well-Architected Framework says long-term IAM access keys should be rotated at a maximum of 90 days when temporary credentials cannot be used. That is AWS guidance for long-term IAM keys; it is not a universal inactivity test or a rotation rule for every OAuth token.
Free tools Windows power users keep installed
One-click scans. No signup required.
Confirm ownership and dependency before removal
- Classify the record. Mark it active, apparently inactive, unknown, expiring, or suspected compromised. Treat unknown as unresolved, not as unused.
- Find the accountable team. Confirm the owner, calling application, environment, and business purpose. If ownership is unclear, trace the credential through the application configuration, deployment records, and available audit activity before taking action.
- Check the replacement path. Verify whether a replacement key, secret, or identity has been deployed and whether every consumer has migrated. A newly created credential is not a replacement until the callers use it.
- Review access. Check permissions or OAuth scopes and identify access that can be reduced as part of the change. AWS recommends regular credential and permission audits, including removal of access that is no longer required.
- Schedule routine production changes. Coordinate with the application owner and use a maintenance window when a failure could affect production or a critical integration. Agree on what will be monitored and how long the reversible stage will last.
Disable, revoke, monitor, then delete
For routine cleanup, use the least disruptive reversible action the provider supports. Disabling a key, revoking a grant, and deleting an OAuth client are not interchangeable. Check the issuer’s behavior before acting, especially when several applications or tokens may depend on one client.
- Notify the owner and record the change. Capture the credential identifier, intended action, approver, timing, and recovery plan without copying the secret itself.
- Disable or revoke first where possible. For a Google Cloud service-account key, Google advises disabling it when it is no longer needed and deleting it once you are certain it is no longer needed. For OAuth, determine whether you are changing a client secret, a user grant, an access token, a refresh token, or the client itself.
- Watch for failures and unexpected use. Monitor authentication errors, application health, audit events, scheduled jobs, and any legitimate use that appears after the change. Keep the observation period long enough to cover the workload’s relevant operating cycle.
- Recover or proceed. If a legitimate dependency fails, restore service using the provider’s supported recovery path and update the migration plan. If no dependency appears during the agreed observation period, delete the retired credential or client and update the inventory.
Google notes that deleting an OAuth client can cause API calls made with associated access or refresh tokens to fail. For client-secret rotation, Google documents a staged approach: add a new secret, migrate consumers while the old secret remains usable, and then disable the old one. Verify that all consumers have migrated before retiring the previous secret.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
AWS Sign-In documents OAuth token introspection, refresh-token revocation, and CloudTrail events for OAuth lifecycle activity. Use the issuer’s documented controls to determine whether revoking one token affects associated tokens, and confirm the outcome in available logs. Do not assume a bulk revocation or client deletion has the same effect across providers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Handle suspected compromise as an incident
Routine cleanup and compromise response have different priorities. If a credential may be exposed or is showing suspicious use, follow the issuer’s incident procedure and revoke it directly through the provider’s mechanism; do not wait for a normal observation period. Review audit activity and investigate how the credential was exposed, what it could access, and whether other credentials need action.
For Google Cloud credentials, Google’s incident guidance warns that suspending a user, resetting a password, or resetting sign-in cookies alone may not invalidate access tokens already held by an attacker. Revoke compromised OAuth tokens directly using Google’s documented mechanism. For other platforms, use their own response procedure rather than assuming password changes invalidate tokens.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prevent the inventory from growing back
- Prefer short-lived credentials. Use temporary credentials or managed workload identity where supported instead of creating another long-lived key.
- Assign ownership and review dates. Give each credential an accountable owner and a planned expiry or review date.
- Store secrets securely and limit access. Restrict permissions to what the workload needs, and keep secret values out of source code, tickets, and inventory records.
- Monitor and review regularly. Alert on unexpected use where supported and repeat the inventory review on a schedule appropriate to your environment.
- Rotate according to the credential’s guidance. Where temporary credentials cannot be used, AWS’s 2025 Well-Architected Framework recommends a maximum of 90 days between rotations for long-term IAM access keys. Follow the relevant provider’s current instructions for other credential types.
What to assess in a credential-inventory tool
Whether you use native dashboards or a separate inventory tool, judge the quality of its evidence and remediation support—not just the number of credentials it lists.
- Does it cover all relevant providers, accounts, SaaS services, and repositories?
- Can it identify individual credentials, or only the parent application?
- How precise are the timestamps and lookback periods, and where are there data gaps?
- Can activity be connected to a specific key, workload, owner, scope, and environment?
- Can you export the results and correlate them with audit logs?
- Does it support reversible disable or revoke actions and record the resulting event?
- Does it help review permissions, alert on use, and migrate workloads to temporary identity?
- What licensing, deployment effort, and tenant data-source requirements apply?
Microsoft App Governance’s coarse or unavailable dates illustrate why signal quality matters: a tool can be useful for triage without proving that a credential is unused. Check its coverage and data quality in the specific tenant before relying on it for deletion decisions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
