LocalCloud Secret Manager Local Emulator
Get started
local.cloud — Secret Manager Local Emulator .md Open tab
LocalCloud Google Cloud in-a-box

Secret Manager

Secret Manager stores versioned sensitive values such as API keys and passwords. Applications retrieve a chosen secret version instead of embedding values in source code.

When to use Secret Manager

Typical uses

Use when applications retrieve credentials or sensitive configuration at runtime, and values need versioning or rotation independently of an application release.

Examples

  • Application configuration secrets
  • Versioned credential rollouts
Security

Explore another service

View all
Local workflow

Example usage

Install the CLI, start LocalCloud, and export its environment in the same shell. Generated endpoints account for remapped ports.

1. Install and start · shell
curl -fsSL https://local.cloud/install.sh | sh
localcloud start --local-only
# Export GOOGLE_CLOUD_PROJECT and SECRET_MANAGER_EMULATOR_HOST
eval "$(localcloud env)"

Load a versioned application secret

  1. Create a secret containing a fake local value.
  2. Add a version and retrieve its payload.
  3. Disable that version and verify the application handles the failure.

Documented workflows

  • Secret CRUD
  • Version add/access/list/enable/disable/destroy
  • SOFTWARE CMEK encryption and per-secret IAM policy APIs

Service boundaries

  • No automatic rotation notifications or topic delivery
  • Authorization varies by transport and IAM mode
  • Hardware key custody and geographic replication are cloud-only
Try it in your project

Code examples and integrations

Start with the local guides. Official Google Cloud samples may need endpoint changes and can cover features outside the workflows listed here.

Terraform · HCL

Provision resources with Terraform

Documented resources, provider configuration, and local routing setup.

Open guide
Integration

Build an integration test loop

Start the runtime, verify readiness, exercise your SDK, and clean up test state.

Open guide
Google Cloud

Official SDK code samples

Browse language-specific samples. Adapt endpoints and use the local workflows listed above.

Browse official samples
Agent testing

Use Secret Manager with an AI agent

Before the agent changes application logic, have it create local Secret Manager state, read it back with the project SDK, and note which feature the check covered. That first local call catches accidental production routing and needs no GCP account, service-account key, or billing project.

Configure this repo

Set up this repository to use LocalCloud for local GCP development. First read https://local.cloud/ai/agents.md, then inspect this repo, identify the GCP services and SDK language, configure emulator environment variables, and run the narrowest integration test against localhost. Do not use real GCP credentials or production endpoints.

Production endpoints, auth, IAM, quotas, regional behavior, and final release validation still need the target Google Cloud project.

Agent resources has more prompts and the AGENTS.md template.

Related guides

Desktop view