Skip to main content
Bruno integrates with Google Cloud Secret Manager to securely fetch secrets for use in your collections. The provider is configured once in Preferences and can then be attached to any collection environment.

​
Configuration steps

  1. Go to Preferences and open the Secrets Manager section from left-bottom sidebar.
  2. Click + Add Secret Manager.
  3. Select GCP Secrets Manager as the provider type.
  4. Enter a Name for the account (for example, Production GCP).
  5. Provide your service account credentials using either method:
    • Upload or paste a GCP service account JSON key - Bruno fills in Default Project ID, Client Email, and Private Key from the file.
    • Or enter the fields manually:
      • Default Project ID - defaults from the key’s project_id, you can change it later per environment when fetching secrets
      • Client Email - for example, service-account@project.iam.gserviceaccount.com
      • Private Key - the private_key value from the service account JSON
  6. Click Test Connection to verify that Bruno can authenticate with the service account.
  7. Click Add (or Save when editing) to save the secret manager configuration.
GCP Secrets Manager preferences Once saved, the account appears in the Secrets Manager list and is available when configuring external secrets on an environment.
Application Default Credentials, gcloud CLI authentication, and Workload Identity Federation are planned for future support. Use a service account key for now.

​
Exporting as a .env file

Once a provider is saved, you can export its configuration as a .env file from Preferences > Secrets Manager. This is useful for passing credentials to the Bruno CLI or seeding a CI/CD pipeline.
  1. In the Secrets Manager list, hover over the account you want to export.
  2. Click the Export as .env icon.
  3. Bruno writes the credentials to a .env file on your machine.
Export GCP Secrets Manager as .env The exported file includes variables such as:
The exported .env file contains your service account private key in plain text. Add it to .gitignore immediately and never commit it to version control.
Pass the exported file to the CLI using the --secrets-env-file flag:

​
Next steps