Weave Code
Cloud Secret Manager Laravel Package
google/cloud-secret-manager
Idiomatic PHP client for Google Cloud Secret Manager. Install via Composer, authenticate with Google Cloud credentials, then use SecretManagerServiceClient to create, access, and manage secrets over REST or gRPC with robust error handling.
Secret Manager Client for PHP
Frequently asked questions about Cloud Secret Manager
- How do I integrate Google Cloud Secret Manager with Laravel’s dependency injection?
- Use Laravel’s service provider to bind the `SecretManagerServiceClient` to the container. Inject the client into services or facades, then fetch secrets dynamically (e.g., `SecretManager::get('db_password')`). The package works idiomatically with Laravel’s DI system.
- Can I replace Laravel’s `.env` file entirely with Google Cloud Secret Manager?
- Yes. Fetch secrets at runtime via the client and expose them as Laravel config values (e.g., `config('services.db.password')`). This eliminates `.env` files from Git while maintaining compatibility with Laravel’s config system.
- What Laravel versions are supported by this package?
- The package is framework-agnostic but works seamlessly with Laravel 8.x–11.x. No Laravel-specific dependencies exist, so it integrates via DI and config. Tested with PHP 8.0+.
- How do I handle secret rotation in Laravel when using Google Cloud Secret Manager?
- Use Secret Manager’s built-in rotation with webhooks (via Cloud Pub/Sub) to trigger Laravel listeners or queued jobs. For example, listen for `secret-version-changed` events and update cached secrets in Redis.
- Is gRPC supported, and should I use it for Laravel in production?
- Yes, gRPC is supported and reduces latency (~50–100ms faster than HTTP/1.1). Enable it via the [gRPC installation guide](https://cloud.google.com/php/grpc) for high-throughput environments like microservices or serverless Laravel apps.
- How do I authenticate locally during development without exposing service account keys?
- Use a local service account JSON key file (stored in `.gitignore`) and set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable. For CI/CD, use Workload Identity Federation to avoid hardcoding keys.
- What’s the best way to cache secrets in Laravel to reduce API calls?
- Cache secrets in Redis with TTL-based invalidation (e.g., `Cache::remember('db_password', now()->addMinutes(5), fn() => SecretManager::get('db_password'))`). This minimizes Secret Manager API calls while keeping secrets fresh.
- Can I use this package for multi-tenant Laravel apps with tenant-specific secrets?
- Yes. Tag secrets in Secret Manager (e.g., `tenant:acme`) and fetch them dynamically based on the current tenant. Use Laravel’s middleware or service providers to resolve tenant-specific secrets at runtime.
- How do I handle fallback secrets if Google Cloud Secret Manager is unavailable?
- Implement a fallback strategy in your Laravel config (e.g., `config(['services.db.password' => env('DB_PASSWORD', SecretManager::get('db_password'))])`). Use Laravel’s exception handler to log failures and gracefully degrade.
- Are there alternatives to this package for Laravel secret management?
- Alternatives include Vault (HashiCorp), AWS Secrets Manager (via `aws/aws-sdk-php`), or Laravel’s built-in `.env` with encryption (e.g., `laravel/env-editor`). However, this package is optimized for GCP-native workflows with IAM, audit logs, and gRPC.
Weaver
How can I help you explore Laravel packages today?