Skip to main content
Version: 0.14

GCP Secret Manager

TokenTimer uses the Secret Manager REST API v1 to discover secrets with expiration dates from Google Cloud Secret Manager.

Project ID: your GCP project ID (for example my-project-123456)

Credential setup​

  1. GCP Console → IAM & Admin → Service Accounts → Create
  2. Assign the role Secret Manager Viewer (roles/secretmanager.viewer)
  3. Create and download a JSON key file
  4. Get a token: gcloud auth application-default print-access-token
  5. Revoke after use. The token is used once and never stored.

Option 2: OAuth2 temporary token​

Use the OAuth2 flow with the https://www.googleapis.com/auth/secretmanager scope.

Permissions required​

IAM roles:

  • roles/secretmanager.viewer (required) - the scan lists secrets and their versions
  • roles/secretmanager.secretAccessor is not sufficient on its own: it reads secret values but cannot list secrets

API scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/secretmanager

What is discovered​

  • Secrets: name, expiration (from enabled versions), creation/update times

Only enabled secret versions are checked for expiration. Metadata only; no secret values are retrieved.

Secret Manager is the only GCP resource type this integration scans today. It does not discover certificates from Certificate Manager or Compute Engine SSL certificates; there is no roles/certificatemanager.viewer requirement because that API is never called. If you store TLS certificates as Secret Manager secrets, they're picked up like any other secret; certificates issued through GCP's own certificate services are not.

info

GCP Secret Manager does not support auto-sync on self-hosted TokenTimer Core. Each scan is a one-time, manual action; credentials are used once and never stored. TokenTimer Enterprise adds scheduled auto-sync for this provider under a per-provider license entitlement; see Enterprise auto-sync.