gcp-secret-manager-keys

name	gcp-secret-manager-keys
description	How to read API keys (OpenAI, Anthropic, Gemini, Perplexity, OpenRouter, Grok) from GCP Secret Manager. Ported from jleechanorg/ai_universe.

GCP Secret Manager — API Key Access

The AI Universe Lite backend reads LLM provider keys from GCP Secret Manager. Keys are never stored in env vars or .env files (except in .env.local for local dev, which is gitignored).

Required secrets

Secret name (in GCP)	Provider
OPENAI_API_KEY	OpenAI
ANTHROPIC_API_KEY	Anthropic
GEMINI_API_KEY	Google Gemini
PERPLEXITY_API_KEY	Perplexity
OPENROUTER_API_KEY	OpenRouter
GROK_API_KEY	xAI Grok

All in project ai-universe-2025.

Local dev

The Cloud Run service account has roles/secretmanager.secretAccessor. For local dev, the developer's gcloud auth login identity must have the same role. Run:

gcloud projects add-iam-policy-binding ai-universe-2025 \
  --member="user:$(gcloud config get-value account)" \
  --role="roles/secretmanager.secretAccessor"

Reading keys from code

import { SecretManagerServiceClient } from "@google-cloud/secret-manager";

const client = new SecretManagerServiceClient();

export async function readSecret(name: string): Promise<string> {
  const [version] = await client.accessSecretVersion({
    name: `projects/ai-universe-2025/secrets/${name}/versions/latest`,
  });
  const payload = version.payload?.data?.toString();
  if (!payload) throw new Error(`Empty secret: ${name}`);
  return payload;
}

Used by backend/src/stores/secrets.ts (Phase 1) and by per-gem loadGemContext when it lazy-loads ctx.callLlm(model, prompt).

Cache strategy

backend/src/stores/secrets.ts caches each secret in memory for 5 minutes (configurable via SECRET_CACHE_TTL_SEC). Cloud Run instances are short-lived; cache hit rate is high within an instance lifetime.

Test the wiring

cd backend
npm run prepare:shared-libs
./scripts/test-api-keys.sh

Expected output: 6 ✅ lines, 0 ❌ lines.

Rotate

echo -n "<new-key>" | gcloud secrets versions add OPENAI_API_KEY --data-file=- --project=ai-universe-2025

New version auto-picks up at next deploy (or next cache TTL in dev).

Source

Ported from jleechanorg/ai_universe's gcp-secret-manager-keys skill. Project and secret names are identical.