Service Account API keys Disappearing

Audit logging. Once turned on, it is permanently on.

Then:

The only thing the events don’t specifically detail is that api_key.deleted would include admin keys - but you can record the value and delete one yourself, along with deleting a project’s API key, and see that you then have logging.

The mystery will then only be in the future if it is “you” who is doing the logged deleting - then you have to go on full lockdown (intrusion without other detected abuse or billings would be a strange thing).