@tamasha/gcp-secret-manager

Load Google Secret Manager secrets directly into process.env without storing service account key files on disk.

This package mirrors the existing internal helper while improving credential hygiene by supporting JSON or base64 encoded service account payloads supplied via environment variables.

Installation

npm install @tamasha/gcp-secret-manager

Usage

import { initializeEnvSecrets } from "@tamasha/gcp-secret-manager";

await initializeEnvSecrets("my-gcp-project", "my-secret-id");

Providing credentials securely

Set one of the following environment variables with either a raw JSON string or a base64 encoded payload of the service account:

• GCP_SERVICE_ACCOUNT
• GCP_SERVICE_ACCOUNT_JSON
• GCP_SERVICE_ACCOUNT_BASE64
• GOOGLE_APPLICATION_CREDENTIALS_JSON

Alternatively, pass the credential value explicitly:

import { loadSecretVariables } from "@tamasha/gcp-secret-manager";

await loadSecretVariables(
  { projectId: "my-project", secretId: "env-vars" },
  { serviceAccountEnvKey: "MY_SERVICE_ACCOUNT_JSON" }
);

If no explicit credentials are provided the client falls back to:

1. GOOGLE_APPLICATION_CREDENTIALS file path (if set)
2. Application Default Credentials on the current GCP runtime (Cloud Run, GKE, etc.)

API

loadSecretVariables(options, authOptions?)

Fetches the latest (or requested) secret version, parses it as JSON, and merges the resulting key/value pairs into process.env. Returns true on success and throws on failure.

fetchSecret(options, authOptions?)

Returns the raw secret payload as a string without mutating process.env.

Error handling

This package never calls process.exit. Any failure surfaces as an exception so callers can decide how to handle missing secrets.

License

MIT © Tamasha Team