Secret Manager Client Libraries

This page shows how to get started with the Cloud Client Libraries for the Secret Manager API. Read more about the client libraries for Cloud APIs in Client Libraries Explained.

Installing the client library

C#

For more information, see Setting Up a C# Development Environment.

Using PowerShell:

$ Install-Package Google.Cloud.SecretManager.V1 -Version 1.0.0

Using the dotnet CLI:

$ dotnet add package Google.Cloud.SecretManager.V1 --version 1.0.0

Go

For more information, see Setting Up a Go Development Environment.

$ go get -u cloud.google.com/go/secretmanager/apiv1
$ go get -u google.golang.org/genproto/googleapis/cloud/secretmanager/v1

Java

For more information, see Setting Up a Java Development Environment.

Si vous utilisez Maven, ajoutez les lignes suivantes à votre fichier pom.xml. Pour en savoir plus sur les BOM, consultez la page The Google Cloud Platform Libraries BOM (BOM des bibliothèques Google Cloud Platform).

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.google.cloud</groupId>
      <artifactId>libraries-bom</artifactId>
      <version>20.2.0</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

<dependencies>
  <dependency>
    <groupId>com.google.cloud</groupId>
    <artifactId>google-cloud-secretmanager</artifactId>
  </dependency>
</dependencies>

Si vous utilisez Gradle, ajoutez les éléments suivants à vos dépendances :

implementation platform('com.google.cloud:libraries-bom:20.2.0')

compile 'com.google.cloud:google-cloud-secretmanager'

Si vous utilisez sbt, ajoutez les éléments suivants à vos dépendances :

libraryDependencies += "com.google.cloud" % "google-cloud-secretmanager" % "1.5.1"

Si vous utilisez IntelliJ ou Eclipse, vous pouvez ajouter des bibliothèques clientes à votre projet à l'aide des plug-ins IDE suivants :

Les plug-ins offrent des fonctionnalités supplémentaires, telles que la gestion des clés pour les comptes de service. Reportez-vous à la documentation de chaque plug-in pour plus de détails.

Node.js

For more information, see Setting Up a Node.js Development Environment.

$ npm install --save @google-cloud/secret-manager

PHP

For more information, see Using PHP on Google Cloud.

$ composer require google/cloud-secret-manager

Python

For more information, see Setting Up a Python Development Environment.

$ pip install google-cloud-secret-manager

Ruby

For more information, see Setting Up a Ruby Development Environment.

$ gem install google-cloud-secret_manager

Setting up authentication

To run the client library, you must first set up authentication by creating a service account and setting an environment variable. Complete the following steps to set up authentication. For other ways to authenticate, see the GCP authentication documentation.

Cloud Console

Créez un compte de service :

  1. Dans Cloud Console, accédez à la page Créer un compte de service.

    Accéder à la page "Créer un compte de service"
  2. Sélectionnez un projet.
  3. Dans le champ Nom du compte de service, saisissez un nom. Cloud Console remplit le champ ID du compte de service en fonction de ce nom.

    Dans le champ Description du compte de service, saisissez une description. Exemple : Service account for quickstart.

  4. Cliquez sur Create (Créer).
  5. Cliquez sur le champ Sélectionner un rôle.

    Dans la section Accès rapide, cliquez sur Basique, puis sur Propriétaire.

  6. Cliquez sur Continuer.
  7. Cliquez sur OK pour terminer la création du compte de service.

    Ne fermez pas la fenêtre de votre navigateur. Vous en aurez besoin lors de la tâche suivante.

Créez une clé de compte de service :

  1. Dans Cloud Console, cliquez sur l'adresse e-mail du compte de service que vous avez créé.
  2. Cliquez sur Clés.
  3. Cliquez sur Ajouter une clé, puis sur Créer une clé.
  4. Cliquez sur Create (Créer). Un fichier de clé JSON est téléchargé sur votre ordinateur.
  5. Cliquez sur Close (Fermer).

Ligne de commande

Vous pouvez exécuter les commandes suivantes à l'aide du SDK Cloud sur votre ordinateur local, ou dans Cloud Shell.

  1. Créez le compte de service. Remplacez NAME par le nom que vous souhaitez donner au compte de service.

    gcloud iam service-accounts create NAME
  2. Accordez des autorisations au compte de service. Remplacez PROJECT_ID par votre ID de projet.

    gcloud projects add-iam-policy-binding PROJECT_ID --member="serviceAccount:NAME@PROJECT_ID.iam.gserviceaccount.com" --role="roles/owner"
  3. Générez le fichier de clé. Remplacez FILE_NAME par le nom du fichier de clé.

    gcloud iam service-accounts keys create FILE_NAME.json --iam-account=NAME@PROJECT_ID.iam.gserviceaccount.com

Fournissez des identifiants d'authentification au code de votre application en définissant la variable d'environnement GOOGLE_APPLICATION_CREDENTIALS. Cette variable ne s'applique qu'à la session d'interface système actuelle. Par conséquent, si vous ouvrez une nouvelle session, vous devez la définir à nouveau.

Linux ou macOS

export GOOGLE_APPLICATION_CREDENTIALS="KEY_PATH"

Remplacez KEY_PATH par le chemin du fichier JSON contenant la clé de votre compte de service.

Exemple :

export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/service-account-file.json"

Windows

Pour PowerShell :

$env:GOOGLE_APPLICATION_CREDENTIALS="KEY_PATH"

Remplacez KEY_PATH par le chemin du fichier JSON contenant la clé de votre compte de service.

Exemple :

$env:GOOGLE_APPLICATION_CREDENTIALS="C:\Users\username\Downloads\service-account-file.json"

Pour l'invite de commande :

set GOOGLE_APPLICATION_CREDENTIALS=KEY_PATH

Remplacez KEY_PATH par le chemin du fichier JSON contenant la clé de votre compte de service.

Using the client library

The following example shows how to use the client library.

C#

To learn how to install and use the client library for Secret Manager, see the Secret Manager Client Libraries. For more information, see the Secret Manager C# API reference documentation.


using System;
using System.Text;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.SecretManager.V1;
using Google.Protobuf;

public class QuickstartSample
{
    public void Quickstart(string projectId = "my-project", string secretId = "my-secret")
    {
        // Create the client.
        SecretManagerServiceClient client = SecretManagerServiceClient.Create();

        // Build the parent project name.
        ProjectName projectName = new ProjectName(projectId);

        // Build the secret to create.
        Secret secret = new Secret
        {
            Replication = new Replication
            {
                Automatic = new Replication.Types.Automatic(),
            },
        };

        Secret createdSecret = client.CreateSecret(projectName, secretId, secret);

        // Build a payload.
        SecretPayload payload = new SecretPayload
        {
            Data = ByteString.CopyFrom("my super secret data", Encoding.UTF8),
        };

        // Add a secret version.
        SecretVersion createdVersion = client.AddSecretVersion(createdSecret.SecretName, payload);

        // Access the secret version.
        AccessSecretVersionResponse result = client.AccessSecretVersion(createdVersion.SecretVersionName);

        // Print the results
        //
        // WARNING: Do not print secrets in production environments. This
        // snippet is for demonstration purposes only.
        string data = result.Payload.Data.ToStringUtf8();
        Console.WriteLine($"Plaintext: {data}");
    }
}

Go

To learn how to install and use the client library for Secret Manager, see the Secret Manager Client Libraries. For more information, see the Secret Manager Go API reference documentation.


// Sample quickstart is a basic program that uses Secret Manager.
package main

import (
	"context"
	"fmt"
	"log"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
	secretmanagerpb "google.golang.org/genproto/googleapis/cloud/secretmanager/v1"
)

func main() {
	// GCP project in which to store secrets in Secret Manager.
	projectID := "your-project-id"

	// Create the client.
	ctx := context.Background()
	client, err := secretmanager.NewClient(ctx)
	if err != nil {
		log.Fatalf("failed to setup client: %v", err)
	}

	// Create the request to create the secret.
	createSecretReq := &secretmanagerpb.CreateSecretRequest{
		Parent:   fmt.Sprintf("projects/%s", projectID),
		SecretId: "my-secret",
		Secret: &secretmanagerpb.Secret{
			Replication: &secretmanagerpb.Replication{
				Replication: &secretmanagerpb.Replication_Automatic_{
					Automatic: &secretmanagerpb.Replication_Automatic{},
				},
			},
		},
	}

	secret, err := client.CreateSecret(ctx, createSecretReq)
	if err != nil {
		log.Fatalf("failed to create secret: %v", err)
	}

	// Declare the payload to store.
	payload := []byte("my super secret data")

	// Build the request.
	addSecretVersionReq := &secretmanagerpb.AddSecretVersionRequest{
		Parent: secret.Name,
		Payload: &secretmanagerpb.SecretPayload{
			Data: payload,
		},
	}

	// Call the API.
	version, err := client.AddSecretVersion(ctx, addSecretVersionReq)
	if err != nil {
		log.Fatalf("failed to add secret version: %v", err)
	}

	// Build the request.
	accessRequest := &secretmanagerpb.AccessSecretVersionRequest{
		Name: version.Name,
	}

	// Call the API.
	result, err := client.AccessSecretVersion(ctx, accessRequest)
	if err != nil {
		log.Fatalf("failed to access secret version: %v", err)
	}

	// Print the secret payload.
	//
	// WARNING: Do not print the secret in a production environment - this
	// snippet is showing how to access the secret material.
	log.Printf("Plaintext: %s", result.Payload.Data)
}

Java

To learn how to install and use the client library for Secret Manager, see the Secret Manager Client Libraries. For more information, see the Secret Manager Java API reference documentation.

import com.google.cloud.secretmanager.v1.AccessSecretVersionResponse;
import com.google.cloud.secretmanager.v1.ProjectName;
import com.google.cloud.secretmanager.v1.Replication;
import com.google.cloud.secretmanager.v1.Secret;
import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
import com.google.cloud.secretmanager.v1.SecretPayload;
import com.google.cloud.secretmanager.v1.SecretVersion;
import com.google.protobuf.ByteString;

public class Quickstart {

  public void quickstart() throws Exception {
    // TODO(developer): Replace these variables before running the sample.
    String projectId = "your-project-id";
    String secretId = "your-secret-id";
    quickstart(projectId, secretId);
  }

  public void quickstart(String projectId, String secretId) throws Exception {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests. After completing all of your requests, call
    // the "close" method on the client to safely clean up any remaining background resources.
    try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) {
      // Build the parent name from the project.
      ProjectName projectName = ProjectName.of(projectId);

      // Create the parent secret.
      Secret secret =
          Secret.newBuilder()
              .setReplication(
                  Replication.newBuilder()
                      .setAutomatic(Replication.Automatic.newBuilder().build())
                      .build())
              .build();

      Secret createdSecret = client.createSecret(projectName, secretId, secret);

      // Add a secret version.
      SecretPayload payload =
          SecretPayload.newBuilder().setData(ByteString.copyFromUtf8("hello world!")).build();
      SecretVersion addedVersion = client.addSecretVersion(createdSecret.getName(), payload);

      // Access the secret version.
      AccessSecretVersionResponse response = client.accessSecretVersion(addedVersion.getName());

      // Print the secret payload.
      //
      // WARNING: Do not print the secret in a production environment - this
      // snippet is showing how to access the secret material.
      String data = response.getPayload().getData().toStringUtf8();
      System.out.printf("Plaintext: %s\n", data);
    }
  }
}

Node.js

To learn how to install and use the client library for Secret Manager, see the Secret Manager Client Libraries. For more information, see the Secret Manager Node.js API reference documentation.

// Import the Secret Manager client and instantiate it:
const {SecretManagerServiceClient} = require('@google-cloud/secret-manager');
const client = new SecretManagerServiceClient();

/**
 * TODO(developer): Uncomment these variables before running the sample.
 */
// parent = 'projects/my-project', // Project for which to manage secrets.
// secretId = 'foo', // Secret ID.
// payload = 'hello world!' // String source data.

async function createAndAccessSecret() {
  // Create the secret with automation replication.
  const [secret] = await client.createSecret({
    parent: parent,
    secret: {
      name: secretId,
      replication: {
        automatic: {},
      },
    },
    secretId,
  });

  console.info(`Created secret ${secret.name}`);

  // Add a version with a payload onto the secret.
  const [version] = await client.addSecretVersion({
    parent: secret.name,
    payload: {
      data: Buffer.from(payload, 'utf8'),
    },
  });

  console.info(`Added secret version ${version.name}`);

  // Access the secret.
  const [accessResponse] = await client.accessSecretVersion({
    name: version.name,
  });

  const responsePayload = accessResponse.payload.data.toString('utf8');
  console.info(`Payload: ${responsePayload}`);
}
createAndAccessSecret();

PHP

To learn how to install and use the client library for Secret Manager, see the Secret Manager Client Libraries. For more information, see the Secret Manager PHP API reference documentation.

// Import the Secret Manager client library.
use Google\Cloud\SecretManager\V1\Replication;
use Google\Cloud\SecretManager\V1\Replication\Automatic;
use Google\Cloud\SecretManager\V1\Secret;
use Google\Cloud\SecretManager\V1\SecretManagerServiceClient;
use Google\Cloud\SecretManager\V1\SecretPayload;

/** Uncomment and populate these variables in your code */
// $projectId = 'YOUR_GOOGLE_CLOUD_PROJECT' (e.g. 'my-project');
// $secretId = 'YOUR_SECRET_ID' (e.g. 'my-secret');

// Create the Secret Manager client.
$client = new SecretManagerServiceClient();

// Build the parent name from the project.
$parent = $client->projectName($projectId);

// Create the parent secret.
$secret = $client->createSecret($parent, $secretId,
  new Secret([
        'replication' => new Replication([
            'automatic' => new Automatic(),
        ]),
    ])
);

// Add the secret version.
$version = $client->addSecretVersion($secret->getName(), new SecretPayload([
    'data' => 'hello world',
]));

// Access the secret version.
$response = $client->accessSecretVersion($version->getName());

// Print the secret payload.
//
// WARNING: Do not print the secret in a production environment - this
// snippet is showing how to access the secret material.
$payload = $response->getPayload()->getData();
printf('Plaintext: %s' . PHP_EOL, $payload);

Python

To learn how to install and use the client library for Secret Manager, see the Secret Manager Client Libraries. For more information, see the Secret Manager Python API reference documentation.

# Import the Secret Manager client library.
from google.cloud import secretmanager

# GCP project in which to store secrets in Secret Manager.
project_id = "YOUR_PROJECT_ID"

# ID of the secret to create.
secret_id = "YOUR_SECRET_ID"

# Create the Secret Manager client.
client = secretmanager.SecretManagerServiceClient()

# Build the parent name from the project.
parent = f"projects/{project_id}"

# Create the parent secret.
secret = client.create_secret(
    request={
        "parent": parent,
        "secret_id": secret_id,
        "secret": {"replication": {"automatic": {}}},
    }
)

# Add the secret version.
version = client.add_secret_version(
    request={"parent": secret.name, "payload": {"data": b"hello world!"}}
)

# Access the secret version.
response = client.access_secret_version(request={"name": version.name})

# Print the secret payload.
#
# WARNING: Do not print the secret in a production environment - this
# snippet is showing how to access the secret material.
payload = response.payload.data.decode("UTF-8")
print("Plaintext: {}".format(payload))

Ruby

To learn how to install and use the client library for Secret Manager, see the Secret Manager Client Libraries. For more information, see the Secret Manager Ruby API reference documentation.

# project_id  = "YOUR-GOOGLE-CLOUD-PROJECT"  # (e.g. "my-project")
# secret_id   = "YOUR-SECRET-ID"             # (e.g. "my-secret")

# Import the Secret Manager client library.
require "google/cloud/secret_manager"

# Create the Secret Manager client.
client = Google::Cloud::SecretManager.secret_manager_service

# Build the parent name from the project.
parent = "projects/#{project_id}"

# Create the parent secret.
secret = client.create_secret(
  parent:    parent,
  secret_id: secret_id,
  secret:    {
    replication: {
      automatic: {}
    }
  }
)

# Add a secret version.
version = client.add_secret_version(
  parent:  secret.name,
  payload: {
    data: "hello world!"
  }
)

# Access the secret version.
response = client.access_secret_version name: version.name

# Print the secret payload.
#
# WARNING: Do not print the secret in a production environment - this
# snippet is showing how to access the secret material.
payload = response.payload.data
puts "Plaintext: #{payload}"

Additional resources