```python
from google.cloud import secretmanager
client = secretmanager.SecretManagerServiceClient()
name = "projects/[PROJECT]/secrets/[SECRET-ID]/versions/latest"
payload = client.access_secret_version(request={"name": name}).payload.data.decode("utf-8")
```
The resource name format is strict: projects/[PROJECT]/secrets/[SECRET-ID]/versions/[VERSION]. VERSION can be a number or `latest`. Get any segment wrong and you get NotFound, not a helpful hint.
IAM: the caller needs the secretmanager.versions.access permission, which roles/secretmanager.secretAccessor grants. Grant it on the specific secret, not the project, when you can:
```
gcloud secrets add-iam-policy-binding [SECRET-ID] --member serviceAccount:[SA-EMAIL] --role roles/secretmanager.secretAccessor
```
latest vs pinned:
- `latest` always resolves to the newest enabled version. Convenient, dangerous with rotation: a rotation can change the value under a running process.
- Production services should pin a version number and bump it deliberately, or handle rotation explicitly.
- Disabled and destroyed versions error on access. Destroyed is permanent; there is no undelete.
Do not:
- Log secret values. Not even at debug. The access call returns bytes; decode and use, never print.
- Store the secret in an env var baked into a container image. Mount it at runtime (Cloud Run --set-secrets) or fetch at startup.
- Grant secretmanager.admin to workloads. Accessor is enough.
Verify: access from the workload identity (not your user) and confirm the value shape without printing it, e.g. check length or a known prefix.