LocalCloud Secret Manager Local Emulator
Get started
local.cloud / agents
Read this page as Markdown ↗
local.cloud — Secret Manager Local Emulator .md Open tab

Secret Manager

Secret Manager stores versioned sensitive values such as API keys and passwords. Applications retrieve a chosen secret version instead of embedding values in source code.

When to use Secret Manager

Typical uses

Use when applications retrieve credentials or sensitive configuration at runtime, and values need versioning or rotation independently of an application release.

Examples

  • Application configuration secrets
  • Versioned credential rollouts

Explore another service

View all

Example usage

Service ID: secretmanager. Starts by default. Use an already running LocalCloud runtime for the examples below.

Export the local project and mapped endpoints in your client process, then use the client settings below. First-time setup

# Export GOOGLE_CLOUD_PROJECT and SECRET_MANAGER_EMULATOR_HOST
eval "$(localcloud env)"

REST gateway examples use the generated HTTP address in SERVICE_USAGE_EMULATOR_HOST; native SDKs can use a different protocol.

Java · REST

List secrets

List stored secrets; Secret Manager separates versioned credentials and configuration from application code.

Call the Google Cloud REST API with the JDK HTTP client. Requires JDK 17+. Results reflect resources already created in your local project.

Discovery check · reads existing local state.

Save as Hello.java

import java.net.URI;
import java.net.http.*;
import java.time.Duration;
import java.util.Objects;

public class Hello {
  public static void main(String[] args) throws Exception {
    var project = Objects.requireNonNull(System.getenv("GOOGLE_CLOUD_PROJECT"));
    var endpoint = Objects.requireNonNull(System.getenv("SERVICE_USAGE_EMULATOR_HOST"));
    var url = URI.create(endpoint.replaceAll("/+$", "") + "/v1/projects/" + project + "/secrets");
    var request = HttpRequest.newBuilder(url).timeout(Duration.ofSeconds(30)).GET().build();
    var client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10)).build();
    var response = client.send(request, HttpResponse.BodyHandlers.ofString());
    if (response.statusCode() >= 400) {
      throw new IllegalStateException(response.statusCode() + ": " + response.body());
    }
    System.out.println(response.body());
  }
}

Run the example

java Hello.java

Verify the result

The request succeeds. An empty list or no printed rows is valid before matching resources exist. Continue with the documented workflows for a resource test.

Verify a resource workflow by creating isolated state, performing the operation, and reading the result back. Run cleanup even after a failure; delete only test-owned resources.

Connection failed? Check localcloud status --verbose, enabled services, and client exports. Stop accidental Google Cloud calls; correct local routing before retrying.

Documented workflows

  • Secret CRUD

    Create a secret containing fake development configuration, inspect its labels, and delete it during cleanup. Verify missing-secret handling without using production credentials.

  • Version add/access/list/enable/disable/destroy

    Add and access a version, disable or destroy it, and check the resulting application error. Use multiple versions to test a local credential rollout.

  • SOFTWARE CMEK encryption and per-secret IAM policy APIs

    Configure a local SOFTWARE KMS key for a secret and test version access with the required IAM policy. Verify denied access and unavailable-key behavior separately from policy readback.

Service boundaries

  • No automatic rotation notifications or topic delivery
  • Authorization varies by transport and IAM mode
  • Hardware key custody and geographic replication are cloud-only
Agent testing

Use Secret Manager with an AI agent

Before the agent changes application logic, have it create local Secret Manager state, read it back with the project SDK, and note which feature the check covered. That first local call catches accidental production routing and needs no GCP account, service-account key, or billing project.

Configure this repo

Set up this repository to use LocalCloud for local GCP development. First read https://local.cloud/ai/agents.md, then inspect this repo, identify the GCP services and SDK language, configure emulator environment variables, and run the narrowest integration test against localhost. Do not use real GCP credentials or production endpoints.

Production endpoints, auth, IAM, quotas, regional behavior, and final release validation still need the target Google Cloud project.

Agent resources has more prompts and the AGENTS.md template.

Related guides

Desktop view