title: How to handle secrets in Google App Engine?
body: <p>My application needs a bunch of secrets to run: database credentials, API credentials, etc. It's running in Google App Engine Standard Java 11. <strong>I need these secrets as environment variables or as arguments to my application</strong>, so that my framework can pick them up and establish the connections accordingly. My particular framework is Spring Boot, but I believe Django, Rails and many others use the same methods.</p>
  
  <p>What's the best way of doing this?</p>
  
  <p>One of the answers I get to this question is to <a href="https://stackoverflow.com/questions/48894662/handling-secrets-in-google-app-engine-standard-environment">use Google Cloud Key Management</a>, which looks promising, but I can't figure out how to turn those values into environment variables in App Engine. Is it possible? I've read  <a href="https://cloud.google.com/docs/authentication/production" rel="noreferrer">Setting Up Authentication for Server to Server Production Applications</a>, but I don't see any indication there about how to turn the secrets into environment variables in App Engine (am I missing it?).</p>
  
  <p>The other alternatives I've seen include hard-coding them in <code>app.yaml</code> or another file that is never committed and lives in my machine, which means I'm the only one who can deploy... I can't even deploy from another machine. This is problematic for me.</p>
  
  <p>Another potential solution I've seen is to delegate the problem to Google Cloud Build, so that it fetches a value/file from CKM and pushes it to App Engine (<a href="https://stackoverflow.com/questions/53502945/how-to-pass-environment-variables-to-the-app-yaml-using-cloud-build/53503450#53503450">1</a>, <a href="https://stackoverflow.com/questions/57455119/add-environment-variable-in-app-yaml-file-during-google-build/57460088#57460088">2</a>). I'm not using GCB and I doubt I will, since it's so basic.</p>
  
  <p>I really wish App Engine had a environment variables page like Heroku does.</p>