node.jsgoogle-cloud-platformgoogle-api-nodejs-clientgoogle-secret-manager

Authenticating with non-default credentials in node.js GCP Secret Manager client


I am trying to to use the @google-cloud/secret-manager package to read secrets from inside an application, and I want it to authenticate with a specific service account, not the default credentials. I can't find any documentation anywhere on how to do this.

import { SecretManagerServiceClient } from '@google-cloud/secret-manager';

const smClient = new SecretManagerServiceClient();

There are no options anywhere in the docs to provide authentication parameters. I'm trying to even use the google-auth-library to authenticate with my service account, but I'm not sure how to even pass that to the secret-manager request.

import { JWT } from 'google-auth-library';

const keyFile = JSON.parse(
    fs.readFileSync(path.resolve(__dirname, '../service-account.json'))
)

const authClient = new JWT({
    email: keyFile.client_email,
    key: keyFile.private_key,
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
});

Solution

  • Google Cloud Client Libraries use a library called Application Default Credentials (ADC) to automatically find your service account credentials. ADC looks for service account credentials in the following order:

    The recommended steps would be to create a service account and set an environment variable accordingly. Also ,there are few examples for common use cases and a brief information in the same document about how to access a secret.

    Hope the above information is useful to you.