Skip to main content
Version: next

GCP Secret Manager

TokenTimer uses the Secret Manager REST API v1 to discover secrets with expiration dates from Google Cloud Secret Manager.

Project ID: your GCP project ID (for example my-project-123456)

Credential setup​

  1. GCP Console → IAM & Admin → Service Accounts → Create
  2. Assign the role Secret Manager Secret Accessor
  3. Create and download a JSON key file
  4. Get a token: gcloud auth application-default print-access-token
  5. Revoke after use. The token is used once and never stored.

Option 2: OAuth2 temporary token​

Use the OAuth2 flow with the https://www.googleapis.com/auth/secretmanager scope.

Permissions required​

IAM roles (one of):

  • roles/secretmanager.secretAccessor (recommended)
  • roles/secretmanager.viewer (alternative)

API scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/secretmanager

What is discovered​

  • Secrets: name, expiration (from enabled versions), creation/update times

Only enabled secret versions are checked for expiration. Metadata only; no secret values are retrieved.

info

GCP Secret Manager does not support auto-sync on self-hosted TokenTimer. Each scan is a one-time, manual action; credentials are used once and never stored.