diff --git a/Gemfile b/Gemfile
index 10c82ec..108634c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -31,6 +31,9 @@ gem 'pagy', '~> 3.8', '>= 3.8.2'
 gem 'rack-cors', '~> 1.1', '>= 1.1.1'
 # Testing
 
+# Read secrets from Google Cloud Secret Manager
+gem 'google-cloud-secret_manager', '~> 1.1', '>= 1.1.3'
+
 group :development, :test do
   gem 'listen', '>= 3.0.5', '< 3.2'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 03c678c..638a11a 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -61,6 +61,8 @@ GEM
       minitest (~> 5.1)
       tzinfo (~> 1.1)
       zeitwerk (~> 2.2, >= 2.2.2)
+    addressable (2.8.5)
+      public_suffix (>= 2.0.2, < 6.0)
     ast (2.4.2)
     backport (1.2.0)
     benchmark (0.2.0)
@@ -85,13 +87,67 @@ GEM
     factory_bot_rails (6.1.0)
       factory_bot (~> 6.1.0)
       railties (>= 5.0.0)
+    faraday (2.7.10)
+      faraday-net_http (>= 2.0, < 3.1)
+      ruby2_keywords (>= 0.0.4)
+    faraday-net_http (3.0.2)
+    faraday-retry (2.2.0)
+      faraday (~> 2.0)
     ffi (1.13.1)
+    gapic-common (0.19.1)
+      faraday (>= 1.9, < 3.a)
+      faraday-retry (>= 1.0, < 3.a)
+      google-protobuf (~> 3.14)
+      googleapis-common-protos (>= 1.3.12, < 2.a)
+      googleapis-common-protos-types (>= 1.3.1, < 2.a)
+      googleauth (~> 1.0)
+      grpc (~> 1.36)
     globalid (0.4.2)
       activesupport (>= 4.2.0)
+    google-cloud-core (1.6.0)
+      google-cloud-env (~> 1.0)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (1.6.0)
+      faraday (>= 0.17.3, < 3.0)
+    google-cloud-errors (1.3.1)
+    google-cloud-secret_manager (1.2.0)
+      google-cloud-core (~> 1.6)
+      google-cloud-secret_manager-v1 (>= 0.1, < 2.a)
+      google-cloud-secret_manager-v1beta1 (>= 0.3, < 2.a)
+    google-cloud-secret_manager-v1 (0.17.2)
+      gapic-common (>= 0.19.1, < 2.a)
+      google-cloud-errors (~> 1.0)
+      grpc-google-iam-v1 (~> 1.1)
+    google-cloud-secret_manager-v1beta1 (0.12.2)
+      gapic-common (>= 0.19.1, < 2.a)
+      google-cloud-errors (~> 1.0)
+      grpc-google-iam-v1 (~> 1.1)
+    google-protobuf (3.24.1)
+    googleapis-common-protos (1.4.0)
+      google-protobuf (~> 3.14)
+      googleapis-common-protos-types (~> 1.2)
+      grpc (~> 1.27)
+    googleapis-common-protos-types (1.8.0)
+      google-protobuf (~> 3.18)
+    googleauth (1.7.0)
+      faraday (>= 0.17.3, < 3.a)
+      jwt (>= 1.4, < 3.0)
+      memoist (~> 0.16)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    grpc (1.57.0)
+      google-protobuf (~> 3.23)
+      googleapis-common-protos-types (~> 1.0)
+    grpc-google-iam-v1 (1.3.0)
+      google-protobuf (~> 3.18)
+      googleapis-common-protos (~> 1.4)
+      grpc (~> 1.41)
     i18n (1.8.5)
       concurrent-ruby (~> 1.0)
     jaro_winkler (1.5.4)
     jsonapi-renderer (0.2.2)
+    jwt (2.7.1)
     kramdown (2.3.1)
       rexml
     kramdown-parser-gfm (1.1.0)
@@ -108,6 +164,7 @@ GEM
       mini_mime (>= 0.1.1)
     marcel (0.3.3)
       mimemagic (~> 0.3.2)
+    memoist (0.16.2)
     method_source (1.0.0)
     mimemagic (0.3.10)
       nokogiri (~> 1)
@@ -116,18 +173,21 @@ GEM
     mini_portile2 (2.8.0)
     minitest (5.14.1)
     msgpack (1.3.3)
+    multi_json (1.15.0)
     nio4r (2.5.2)
     nokogiri (1.13.8)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     on_container (0.0.16)
       activesupport (>= 4)
+    os (1.1.4)
     pager_api (0.3.2)
     pagy (3.8.3)
     parallel (1.21.0)
     parser (3.1.0.0)
       ast (~> 2.4.1)
     pg (1.5.3)
+    public_suffix (5.0.3)
     puma (4.3.12)
       nio4r (~> 2.0)
     racc (1.6.0)
@@ -215,9 +275,15 @@ GEM
     ruby-debug-ide (0.7.3)
       rake (>= 0.8.1)
     ruby-progressbar (1.11.0)
+    ruby2_keywords (0.0.5)
     ruby_dep (1.5.0)
     shoulda-matchers (4.3.0)
       activesupport (>= 4.2.0)
+    signet (0.17.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
     solargraph (0.44.3)
       backport (~> 1.2)
       benchmark
@@ -269,6 +335,7 @@ DEPENDENCIES
   csv (~> 3.1, >= 3.1.5)
   debase (~> 0.2.4.1)
   factory_bot_rails (~> 6.1)
+  google-cloud-secret_manager (~> 1.1, >= 1.1.3)
   listen (>= 3.0.5, < 3.2)
   on_container (~> 0.0.16)
   pager_api (~> 0.3.2)