title: Can't access secret in GCP Secret Manager
body: <p>I'm trying to migrate my code from using API keys stored in the <code>.env</code> file to using Google Cloud Platform Secrets Manager. I've followed the instructions <a href="https://cloud.google.com/secret-manager/docs/reference/libraries#command-line" rel="noreferrer">here</a> but I encounter an error saying that I don't have permissions to access the secret.</p>
  <pre class="lang-js prettyprint-override"><code>import * as admin from &quot;firebase-admin&quot;
  import { SecretManagerServiceClient } from &quot;@google-cloud/secret-manager&quot;
  
  admin.initializeApp()
  const secretClient = new SecretManagerServiceClient()
  
  async function main() {
    async function getSecret(): Promise&lt;string | null | undefined&gt; {
      const [version] = await secretClient.accessSecretVersion({ name: &quot;TELEGRAM_TOKEN&quot; })
  
      return version.payload?.data?.toString()
    }
  
    const TELEGRAM_TOKEN = await getSecret()
    console.log(TELEGRAM_TOKEN)
  }
  
  main().catch(console.error)
  </code></pre>
  <p>And that's the error I get:</p>
  <pre><code>&gt; node lib/app.js --telegram
  
  { Error: 7 PERMISSION_DENIED: Permission denied on resource project TELEGRAM_TOKEN.
      at Object.callErrorFromStatus (/Users/bartekpacia/dev/node/telegram-lang-enforcer/node_modules/@grpc/grpc-js/build/src/call.js:30:26)
      at Object.onReceiveStatus (/Users/bartekpacia/dev/node/telegram-lang-enforcer/node_modules/@grpc/grpc-js/build/src/client.js:174:52)
      at Object.onReceiveStatus (/Users/bartekpacia/dev/node/telegram-lang-enforcer/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:340:141)
      at Object.onReceiveStatus (/Users/bartekpacia/dev/node/telegram-lang-enforcer/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:303:181)
      at Http2CallStream.outputStatus (/Users/bartekpacia/dev/node/telegram-lang-enforcer/node_modules/@grpc/grpc-js/build/src/call-stream.js:114:27)
      at Http2CallStream.maybeOutputStatus (/Users/bartekpacia/dev/node/telegram-lang-enforcer/node_modules/@grpc/grpc-js/build/src/call-stream.js:153:22)
      at Http2CallStream.endCall (/Users/bartekpacia/dev/node/telegram-lang-enforcer/node_modules/@grpc/grpc-js/build/src/call-stream.js:140:18)
      at Http2CallStream.handleTrailers (/Users/bartekpacia/dev/node/telegram-lang-enforcer/node_modules/@grpc/grpc-js/build/src/call-stream.js:262:14)
      at ClientHttp2Stream.emit (events.js:198:13)
      at emit (internal/http2/core.js:265:8)
    code: 7,
    details: 'Permission denied on resource project TELEGRAM_TOKEN.',
    metadata:
     Metadata {
       internalRepr:
        Map {
          'google.rpc.help-bin' =&gt; [Array],
          'grpc-status-details-bin' =&gt; [Array],
          'grpc-server-stats-bin' =&gt; [Array] },
       options: {} },
    note:
     'Exception occurred in retry method that was not classified as transient' }
  </code></pre>
  <p>I did create a Service Account with &quot;Owner&quot; permissions, downloaded it and made <code>export GOOGLE_APPLICATION_CREDENTIALS=/Users/...</code>. My service account .json file location is correctly displayed when I execute <code>echo $GOOGLE_APPLICATION_CREDENTIALS</code>.</p>
  <p>I have really no idea what I'm doing wrong.</p>