Weave Code
Cloud Secret Manager Laravel Package
google/cloud-secret-manager
Idiomatic PHP client for Google Cloud Secret Manager. Install via Composer and authenticate with Google Cloud. Supports REST and gRPC, with generated V1 client classes for managing secrets and versions. GA and maintained within Google Cloud PHP.
Secret Manager for PHP is the idiomatic PHP client for Google Cloud Secret Manager, offering typed, generated access to the full V1 API. Install it with Composer via composer require google/cloud-secret-manager, authenticate using Application Default Credentials, and start managing secrets in minutes.
Features:
- Secret management — create, update, list, and delete secrets
- Version handling — add, access, disable, or destroy secret versions
- Access control — read and update IAM policies on secrets
- Dual transports — REST over HTTP/1.1 or gRPC for streaming benefits
- GA stability — no backwards-incompatible changes in minor or patch releases
Frequently asked questions about Cloud Secret Manager
- How do I install google/cloud-secret-manager in Laravel?
- Install it with composer require google/cloud-secret-manager. The client supports REST over HTTP/1.1 and gRPC, so install the gRPC extension if you want lower latency. After authenticating with Google Cloud, bind SecretManagerServiceClient in a Laravel service provider or resolve it from the container.
- How do I authenticate Google Cloud Secret Manager in a Laravel app?
- Create a Google Cloud service account and grant it roles/secretmanager.secretAccessor for the secrets it needs. Provide credentials through GOOGLE_APPLICATION_CREDENTIALS for local development or use Workload Identity Federation and attached service accounts on Cloud Run, GKE, or App Engine. Avoid committing static keys and scope IAM roles to least privilege.
- Can I use google/cloud-secret-manager to replace Laravel .env secrets?
- Yes. You can fetch secrets at runtime with SecretManagerServiceClient and map them into Laravel config values during bootstrap or in a service provider. Cache fetched values in Redis or Laravel Cache with a TTL to avoid an API call on every request. Keep a fallback path for non-critical secrets so a GCP outage does not take down the app.
- How do I inject SecretManagerServiceClient into Laravel services?
- Register SecretManagerServiceClient as a singleton in a Laravel service provider, passing your project ID and optional client options. Bind the class or a small wrapper interface into the container, then type-hint it in constructors, jobs, and controllers. This keeps secret access testable and avoids static calls scattered through the codebase.
- Does google/cloud-secret-manager support Laravel on Cloud Run and GKE?
- Yes. It fits Laravel apps on Cloud Run, GKE, App Engine, and Compute Engine because those environments can attach a service account with Secret Manager access. Fetch secrets at runtime so container images do not need to be rebuilt for each environment. Use Secret Manager tags or naming conventions for staging, production, and tenant-specific secrets.
- How do I cache Google Cloud secrets in Laravel to reduce latency?
- Store fetched secret values in Laravel Cache, such as Redis, with a TTL that matches your rotation policy. Fetch from Secret Manager only on a cache miss or after invalidation. Use a Cloud Pub/Sub rotation listener or queued Laravel job to clear the cache when a secret version changes.
- What IAM permissions are required for Secret Manager in Laravel?
- Reading secret payloads usually requires roles/secretmanager.secretAccessor on the specific secret or project. Creating and rotating versions requires additional permissions such as secretmanager.versions.add or a suitable admin role. Grant access only to the service account used by your Laravel app and avoid broad project-level roles when possible.
- How do I handle ApiException errors from Secret Manager in Laravel?
- Catch ApiException from Google ApiCore around Secret Manager calls and let Laravel's exception handler log the failure. For non-critical secrets, fall back to .env or a cached value; for critical secrets, fail closed. Never log the secret payload or full request credentials.
- Is google/cloud-secret-manager compatible with Laravel 10 and 11?
- The package is framework-agnostic and works with Laravel versions that support its PHP and Composer requirements. Use the GA v2.x release and check your PHP version before installing. No official Laravel service provider is bundled, so you wire the client into the container yourself.
- What are alternatives to google/cloud-secret-manager for Laravel secrets?
- Alternatives include AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, Laravel's encrypted config or environment handling, or calling the Secret Manager REST API directly. Choose based on your cloud provider, IAM model, audit requirements, and whether you need gRPC. This package remains the idiomatic PHP client when your secrets live in Google Cloud.
Weaver
How can I help you explore Laravel packages today?