The situation:
Calling the Secret Manager API fails with: Error: 7 PERMISSION_DENIED: Secret Manager API has not been used in project 698910892233 before or it is disabled, but that project number is not the caller's project. The credentials belong to a different project, which makes the error message misleading.
What actually fixes it (verified in the thread):
This misleading error means the secret name you passed is not a full resource path. Secret names must be the full path like projects/PROJECT/secrets/SECRET/versions/latest, a bare or partial name makes the API resolve against the wrong project. Check that your project ID is actually being injected (a misnamed .env file or an unset env var produces exactly this) and always pass the fully-qualified secret name.