Starts by default

The Secret Manager API, for code paths, not secrets.

Secrets and versions over gRPC and JSON on one port. Not a secret store: nothing is authenticated.

Backed by: CloudBurrow CloudBurrow

In the console

Secret Manager secrets, listed without their values — Captured 2026-09-28 from main @5da2bd0. Product icons hidden.

A secret and its versions; payloads are never listed — Captured 2026-09-28 from main @5da2bd0. Product icons hidden.

What it covers

Secret Manager is built by CloudBurrow and serves gRPC and JSON on one port, as Google’s endpoint does. It is not a secret store: nothing is authenticated. It exists so an application whose code reads Secret Manager runs locally.

Secrets and versions
Enable, disable, destroy and access versions
gRPC and JSON on one port
Environment variables for Cloud Run services

Tested snippet

From docs/examples/ at main 82a2eb9. CI runs these blocks against CloudBurrow.

Python · Secret Manager

import os, uuid, grpc
from google.cloud import secretmanager
from google.cloud.secretmanager_v1.services.secret_manager_service.transports import SecretManagerServiceGrpcTransport

channel = grpc.insecure_channel(os.environ["CLOUDBURROW_SECRETMANAGER_ENDPOINT"])
client = secretmanager.SecretManagerServiceClient(transport=SecretManagerServiceGrpcTransport(channel=channel))

secret = client.create_secret(parent=f"projects/{os.environ['GOOGLE_CLOUD_PROJECT']}",
                              secret_id=f"example-{uuid.uuid4().hex[:12]}",
                              secret={"replication": {"automatic": {}}})
client.add_secret_version(parent=secret.name, payload={"data": b"s3cret"})
assert client.access_secret_version(name=f"{secret.name}/versions/latest").payload.data == b"s3cret"
client.delete_secret(name=secret.name)

This block is run by CloudBurrow's Python suite in CI. If it stops working, CI fails. docs/examples/python.md

Node.js · Secret Manager

import assert from 'node:assert/strict';
import { randomUUID } from 'node:crypto';
import { SecretManagerServiceClient } from '@google-cloud/secret-manager';
import { grpc } from 'google-gax';

const endpoint = new URL(`http://${process.env.CLOUDBURROW_SECRETMANAGER_ENDPOINT}`);
const client = new SecretManagerServiceClient({
  apiEndpoint: endpoint.hostname,
  port: Number(endpoint.port),
  sslCreds: grpc.credentials.createInsecure(),
});

const [secret] = await client.createSecret({
  parent: `projects/${process.env.GOOGLE_CLOUD_PROJECT}`,
  secretId: `example-${randomUUID()}`,
  secret: { replication: { automatic: {} } },
});
await client.addSecretVersion({ parent: secret.name, payload: { data: Buffer.from('s3cret') } });
const [version] = await client.accessSecretVersion({ name: `${secret.name}/versions/latest` });
assert.equal(Buffer.from(version.payload.data).toString(), 's3cret');
await client.deleteSecret({ name: secret.name });
await client.close();

This block is run by CloudBurrow's Node.js suite in CI. If it stops working, CI fails. docs/examples/node.md