> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paradime.io/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Secret Manager

## GCP Secret Manager

Connect GCP Secret Manager to Paradime so you can reference secrets by resource name in your environment variables and connection profiles — without ever storing plaintext credentials in Paradime.

### Prerequisites

* A Google Cloud project with the **Secret Manager API** enabled.
* A service account with the **Secret Manager Secret Accessor** role (`roles/secretmanager.secretAccessor`) on the secrets you want to reference.
* A JSON key file for the service account.

### Step 1 — Create a service account

1. In the **Google Cloud Console**, go to **IAM & Admin > Service accounts**.
2. Click **Create Service Account** and give it a descriptive name (e.g. `paradime-secrets`).
3. Grant the service account the **Secret Manager Secret Accessor** role on the project or on individual secrets.
4. Under **Keys**, click **Add Key > Create new key**, select **JSON**, and download the key file.

<Info>
  For least-privilege access, grant the role on individual secrets rather than at the project level.
</Info>

### Step 2 — Connect in Paradime

1. Navigate to **Settings > Integrations**.
2. Find **GCP Secret Manager** under the **Secret Managers** category and click **Connect**.
3. Fill in the required fields:

| Field                             | Description                                                                            |
| --------------------------------- | -------------------------------------------------------------------------------------- |
| **Service Account JSON**          | Paste the full contents of the JSON key file downloaded in Step 1.                     |
| **Default Project**\*(optional)\* | A default GCP project ID. If set, you can omit the project from short-form references. |

4. Click **Test connection** to verify the credentials.

### Step 3 — Reference secrets

Once connected, use GCP Secret Manager resource names anywhere Paradime accepts environment variable values or connection profile fields.

#### Reference format

```text theme={"system"}
projects/<project-id>/secrets/<secret-name>/versions/latest
```

To pin a specific version:

```text theme={"system"}
projects/<project-id>/secrets/<secret-name>/versions/<version-number>
```

#### Extracting a JSON key

If your secret value is a JSON object, append `#key_name` to extract a specific field:

```text theme={"system"}
projects/my-project/secrets/prod-db-creds/versions/latest#password
```

#### Example — Bolt environment variable

| Variable             | Value                                                            |
| -------------------- | ---------------------------------------------------------------- |
| `SNOWFLAKE_PASSWORD` | `projects/my-project/secrets/snowflake-password/versions/latest` |

Paradime resolves the resource name to the live secret value at schedule run time. The plaintext value is never stored in Paradime.

### Disconnecting

To remove the GCP Secret Manager integration:

1. Navigate to **Settings > Integrations**.
2. Click **Disconnect** on the GCP Secret Manager card.

<Warning>
  Any environment variables or profile fields that reference GCP Secret Manager resource names will fail to resolve after disconnecting. Update them to use literal values before disconnecting.
</Warning>


## Related topics

- [AWS Secret Manager](/integrations/aws-secret-manager.md)
- [BigQuery OAuth](/products/settings/connections/connection-security/bigquery-oauth.md)
- [Column-Level Lineage Diff [deprecated]](/products/bolt/ci-cd/lineage-diff-deprecated/index.md)
- [BitBucket](/products/bolt/ci-cd/turbo-ci/bitbucket.md)
- [Using GitLab Pipelines](/products/bolt/ci-cd/continuous-deployment-with-bolt/using-gitlab-pipelines.md)