> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paradime.io/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Secret Manager

> Reference GCP Secret Manager secrets by resource name in your Paradime environment variables and connection profiles, without storing plaintext credentials.

Connect GCP Secret Manager to Paradime so you can reference secrets by resource name in your environment variables and connection profiles, without ever storing plaintext credentials in Paradime.

## Prerequisites

* A Google Cloud project with the **Secret Manager API** enabled.
* A service account with the **Secret Manager Secret Accessor** role (`roles/secretmanager.secretAccessor`) on the secrets you want to reference.
* A JSON key file for the service account.

## Step 1: Create a service account

1. In the **Google Cloud Console**, go to **IAM & Admin > Service accounts**.
2. Click **Create Service Account** and give it a descriptive name (e.g. `paradime-secrets`).
3. Grant the service account the **Secret Manager Secret Accessor** role on the project or on individual secrets.
4. Under **Keys**, click **Add Key > Create new key**, select **JSON**, and download the key file.

<Info>
  For least-privilege access, grant the role on individual secrets rather than at the project level.
</Info>

## Step 2: Connect in Paradime

1. In Paradime, go to **Settings → Integrations** (see [connecting integrations](/integrations/connecting-integrations)).
2. Find **GCP Secret Manager** under the **Secret Managers** category and click **Connect**.
3. Fill in the required fields:

| Field                             | Description                                                                            |
| --------------------------------- | -------------------------------------------------------------------------------------- |
| **Service Account JSON**          | Paste the full contents of the JSON key file downloaded in Step 1.                     |
| **Default Project**\*(optional)\* | A default GCP project ID. If set, you can omit the project from short-form references. |

4. Click **Test connection** to verify the credentials.

## Step 3: Reference secrets

Once connected, use GCP Secret Manager resource names anywhere Paradime accepts environment variable values or connection profile fields.

### Reference format

```text theme={"system"}
projects/<project-id>/secrets/<secret-name>/versions/latest
```

To pin a specific version:

```text theme={"system"}
projects/<project-id>/secrets/<secret-name>/versions/<version-number>
```

### Extracting a JSON key

If your secret value is a JSON object, append `#key_name` to extract a specific field:

```text theme={"system"}
projects/my-project/secrets/prod-db-creds/versions/latest#password
```

### Example: Bolt environment variable

| Variable             | Value                                                            |
| -------------------- | ---------------------------------------------------------------- |
| `SNOWFLAKE_PASSWORD` | `projects/my-project/secrets/snowflake-password/versions/latest` |

Paradime resolves the resource name to the live secret value at schedule run time. The plaintext value is never stored in Paradime.

## Disconnecting

To remove the GCP Secret Manager integration:

1. Navigate to **Settings → Integrations**.
2. Click **Disconnect** on the GCP Secret Manager card.

<Warning>
  Any environment variables or profile fields that reference GCP Secret Manager resource names will fail to resolve after disconnecting. Update them to use literal values before disconnecting.
</Warning>


## Related topics

- [Integrations](/integrations/index.md)
- [AWS Secret Manager](/integrations/aws-secret-manager.md)
- [Azure Key Vault](/integrations/azure-key-vault.md)
- [GCP Dataflow](/integrations/gcp-dataflow.md)
- [GCP Dataproc](/integrations/gcp-dataproc.md)