# Secret Manager

> Run Secret Manager locally with LocalCloud: connection settings, supported workflows, known limits, and code examples.
>
> Source: https://local.cloud/services/secret-manager/

Secret Manager stores versioned sensitive values such as API keys and passwords. Applications retrieve a chosen secret version instead of embedding values in source code.

## Typical uses

Use when applications retrieve credentials or sensitive configuration at runtime, and values need versioning or rotation independently of an application release.

Examples

- Application configuration secrets
- Versioned credential rollouts

Connection

Environment variable

`SECRET_MANAGER_EMULATOR_HOST=localhost:5380`

Runtime details

- **Endpoints:** gRPC :5380
- **Minimum tier:** Community
- **Persistence:** service-data
- **Implementation:** Local Facade

## Example usage

Service ID: `secretmanager`. Starts by default. Use an already running LocalCloud runtime for the examples below.

Export the local project and mapped endpoints in your client process, then use the client settings below. [First-time setup](https://local.cloud/docs/)

```bash
# Export GOOGLE_CLOUD_PROJECT and SECRET_MANAGER_EMULATOR_HOST
eval "$(localcloud env)"
```

REST gateway examples use the generated HTTP address in `SERVICE_USAGE_EMULATOR_HOST`; native SDKs can use a different protocol.

Java · REST:

### Java · REST

### List secrets

List stored secrets; Secret Manager separates versioned credentials and configuration from application code.

Call the Google Cloud REST API with the JDK HTTP client. Requires JDK 17+. Results reflect resources already created in your local project.

Discovery check · reads existing local state.

#### Save as Hello.java

```java
import java.net.URI;
import java.net.http.*;
import java.time.Duration;
import java.util.Objects;

public class Hello {
  public static void main(String[] args) throws Exception {
    var project = Objects.requireNonNull(System.getenv("GOOGLE_CLOUD_PROJECT"));
    var endpoint = Objects.requireNonNull(System.getenv("SERVICE_USAGE_EMULATOR_HOST"));
    var url = URI.create(endpoint.replaceAll("/+$", "") + "/v1/projects/" + project + "/secrets");
    var request = HttpRequest.newBuilder(url).timeout(Duration.ofSeconds(30)).GET().build();
    var client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10)).build();
    var response = client.send(request, HttpResponse.BodyHandlers.ofString());
    if (response.statusCode() >= 400) {
      throw new IllegalStateException(response.statusCode() + ": " + response.body());
    }
    System.out.println(response.body());
  }
}
```

#### Run the example

```bash
java Hello.java
```

#### Verify the result

The request succeeds. An empty list or no printed rows is valid before matching resources exist. Continue with the documented workflows for a resource test.

gcloud CLI:

### gcloud CLI

### List secrets

List stored secrets; Secret Manager separates versioned credentials and configuration from application code.

Use the Google Cloud CLI against the local gateway in its default open IAM mode. Run these exports in a terminal dedicated to local development.

Discovery check · reads existing local state.

#### Configure gcloud CLI

```bash
: "${SERVICE_USAGE_EMULATOR_HOST:?Export the LocalCloud environment first}"
export CLOUDSDK_CORE_PROJECT="${GOOGLE_CLOUD_PROJECT:?Export the LocalCloud environment first}"
export CLOUDSDK_AUTH_DISABLE_CREDENTIALS=true
export CLOUDSDK_API_ENDPOINT_OVERRIDES_SECRETMANAGER="${SERVICE_USAGE_EMULATOR_HOST%/}/"
```

#### Run in your terminal

```bash
gcloud secrets list
```

#### Verify the result

The request succeeds. An empty list or no printed rows is valid before matching resources exist. Continue with the documented workflows for a resource test.

Verify a resource workflow by creating isolated state, performing the operation, and reading the result back. Run cleanup even after a failure; delete only test-owned resources.

Connection failed? Check `localcloud status --verbose`, enabled services, and client exports. Stop accidental Google Cloud calls; correct local routing before retrying.

## Documented workflows

- ### Secret CRUD

    Create a secret containing fake development configuration, inspect its labels, and delete it during cleanup. Verify missing-secret handling without using production credentials.

- ### Version add/access/list/enable/disable/destroy

    Add and access a version, disable or destroy it, and check the resulting application error. Use multiple versions to test a local credential rollout.

- ### SOFTWARE CMEK encryption and per-secret IAM policy APIs

    Configure a local SOFTWARE KMS key for a secret and test version access with the required IAM policy. Verify denied access and unavailable-key behavior separately from policy readback.

## Service boundaries

- No automatic rotation notifications or topic delivery
- Authorization varies by transport and IAM mode
- Hardware key custody and geographic replication are cloud-only

## Code examples and integrations

- [Provision resources with Terraform](https://local.cloud/docs/terraform/#supported-terraform-resources): Documented resources, provider configuration, and local routing setup.
- [Build an integration test loop](https://local.cloud/gcp-integration-testing/): Start the runtime, verify readiness, exercise your SDK, and clean up test state.
- [Official SDK code samples](https://docs.cloud.google.com/secret-manager/docs/samples): Browse language-specific samples. Adapt endpoints and use the local workflows listed above.

Agent testing

## Use Secret Manager with an AI agent

Before the agent changes application logic, have it create local Secret Manager state, read it back with the project SDK, and note which feature the check covered. That first local call catches accidental production routing and needs no GCP account, service-account key, or billing project.

### Configure this repo

```
Set up this repository to use LocalCloud for local GCP development. First read https://local.cloud/ai/agents.md, then inspect this repo, identify the GCP services and SDK language, configure emulator environment variables, and run the narrowest integration test against localhost. Do not use real GCP credentials or production endpoints.
```

Production endpoints, auth, IAM, quotas, regional behavior, and final release validation still need the target Google Cloud project.

[Agent resources](https://local.cloud/ai/) has more prompts and the AGENTS.md template.

## Related guides

- [Compatibility](https://local.cloud/compatibility/): compare all 27 service guides.
- [Configuration](https://local.cloud/docs/configuration/): service selection and runtime settings.
- [Official Secret Manager documentation](https://docs.cloud.google.com/secret-manager/docs/overview): service concepts and cloud usage.