> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pragmatiks.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret

> Store secrets in GCP Secret Manager

> Creates and manages secrets in GCP Secret Manager with automatic versioning.

## Config

| Field         | Type               | Required | Default | Description                            |
| ------------- | ------------------ | -------- | ------- | -------------------------------------- |
| `project_id`  | `string`           | **Yes**  | —       | GCP project ID                         |
| `secret_id`   | `string`           | **Yes**  | —       | Secret identifier (unique per project) |
| `data`        | `string`           | **Yes**  | —       | Secret payload to store                |
| `credentials` | `dict` or `string` | **Yes**  | —       | GCP service account credentials JSON   |

## Outputs

| Field           | Type     | Description                                                |
| --------------- | -------- | ---------------------------------------------------------- |
| `resource_name` | `string` | Full GCP resource name (`projects/{project}/secrets/{id}`) |
| `version_name`  | `string` | Full version resource name including version number        |
| `version_id`    | `string` | The version number                                         |

## Dependencies

**Depends on:** Nothing.

**Depended on by:** Resources that need GCP Secret Manager metadata (version tracking, resource naming).

## Example

```yaml theme={"theme":{"light":"min-light","dark":"min-dark"}}
provider: gcp
resource: secret
name: anthropic-key
config:
  project_id: my-project
  secret_id: anthropic-api-key
  data: "sk-ant-..."
  credentials:
    type: service_account
    project_id: my-project
    # ... rest of service account JSON
```

## Referencing Secrets

`gcp/secret` outputs GCP metadata (`resource_name`, `version_name`, `version_id`) — not the actual secret value. To inject secret values (like API keys) into other resources, use `pragma/secret` instead, which outputs its `data` keys directly as fields:

```yaml theme={"theme":{"light":"min-light","dark":"min-dark"}}
# pragma/secret outputs its data keys as fields
# If config.data = {ANTHROPIC_API_KEY: "sk-ant-..."}, then outputs.ANTHROPIC_API_KEY is available
api_key:
  provider: pragma
  resource: secret
  name: anthropic-key
  field: outputs.ANTHROPIC_API_KEY
```

## Notes

* The `project_id` and `secret_id` fields are **immutable** — changing them requires deleting and recreating the resource.
* Updates to `data` create a new secret version automatically.
* If the secret already exists in GCP, creation is idempotent — it adds a new version to the existing secret.
* Deletion removes the secret and all its versions permanently.