Home Original page

Create and access a secret using Secret Manager

Learn how to create and access secrets using Secret Manager on Google Cloud.

To follow step-by-step guidance for this task directly in the Google Cloud console, click Guide me:

Guide me

Before you begin

  1. Enable the Secret Manager API, once per project.
  2. Assign the Secret Manager Admin role (roles/secretmanager.admin) on the project, folder, or organization.

  3. Authenticate to the Secret Manager API using one of the following ways:

    • If you're using client libraries to access the Secret Manager API, set up Application Default Credentials.
    • If you're using the Google Cloud CLI to access the Secret Manager API, use your Google Cloud CLI credentials to authenticate.
    • To authenticate a REST call, use either Google Cloud CLI credentials or Application Default Credentials.

Create a secret and access a secret version

The following examples demonstrate creating a secret and accessing a secret version's contents.

Console

To create the secret and the secret version:

  1. Go to the Secret Manager page in the Google Cloud console.

    Go to the Secret Manager page

  2. On the Secret Manager page, click Create Secret.

  3. On the Create secret page, under Name, enter my-secret.

  4. In the Secret value field, enter my super secret data.

  5. Click the Create secret button.

To access the contents of the secret version:

  1. Go to the Secret Manager page in the Google Cloud console.

    Go to the Secret Manager page

  2. On the Secret Manager page, click on my-secret.

  3. On the Secret details page, in the Versions table, locate version 1.

  4. In the Actions column, click View more.

  5. Click View secret value from the menu.

  6. A dialog appears that shows the secret value. Click Done to close the dialog.

gcloud

To use Secret Manager on the command line, first Install or upgrade to version 378.0.0 or higher of the Google Cloud CLI. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

To create a secret and store a string as the contents of the first secret version:

$ echo -n "my super secret data" | gcloud secrets create my-secret \
    --replication-policy="replication-policy" \
    --data-file=-

Where replication-policy is one of automatic or user-managed.

To access the contents of a specific secret version:

$ gcloud secrets versions access 1 --secret="my-secret"

To access the contents of the latest secret version:

$ gcloud secrets versions access latest --secret="my-secret"

C#

To run this code, first set up a C# development environment and install the Secret Manager C# SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

Go

To run this code, first set up a Go development environment and install the Secret Manager Go SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

Java

To run this code, first set up a Java development environment and install the Secret Manager Java SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

Node.js

To run this code, first set up a Node.js development environment and install the Secret Manager Node.js SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

PHP

To run this code, first learn about using PHP on Google Cloud and install the Secret Manager PHP SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

Python

To run this code, first set up a Python development environment and install the Secret Manager Python SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

Ruby

To run this code, first set up a Ruby development environment and install the Secret Manager Ruby SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

API

These examples use curl to demonstrate using the API. You can generate access tokens with gcloud auth print-access-token. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

To create the secret and store a string as the contents of a secret version:

$ curl "https://secretmanager.googleapis.com/v1/projects/project-id/secrets?secretId=my-secret" \
    --request "POST" \
    --header "authorization: Bearer $(gcloud auth print-access-token)" \
    --header "content-type: application/json" \
    --data "{\"replication\": {\"automatic\": {}}}"

To access the secret version's contents:

$ curl "https://secretmanager.googleapis.com/v1/projects/project-id/secrets/my-secret/versions/1:access" \
    --request "GET" \
    --header "authorization: Bearer $(gcloud auth print-access-token)" \
    --header "content-type: application/json"

What's next