How to use Json files as environment variables with vercel

[TravisC671]

Hello! I have just set up Vercel and one of my environment variables on my local directory is GOOGLE_APPLICATION_CREDENTIALS=./secrets.json
and that links to secrets.json which contains all my oath and API keys. How would I set that up with Vercel in a secure way? I have tried just pasting the JSON file but it does not like that and gives a huge error.

[leerob]

You could encrypt the JSON file and add it as an Environment Variable: https://vercel.com/support/articles/how-do-i-workaround-vercel-s-4-kb-environment-variables-limit

[TravisC671]

Hello, I have been looking at this, and it seems like the correct answer, but is there a way to set the unencrypted variable to an environment variable?
https://cloud.google.com/docs/authentication/getting-started#windows
for the Google API, it looks explicitly for the GOOGLE_APPLICATION_CREDENTIALS environment variable. What would be the right way to approach this?

[TravisC671]

Or maybe I could decrypt and edit the JSON that GOOGLE_APPLICATION_CREDENTIALS points to at build time. That way, my IV and my key would be left out of GitHub but kept in the final build. Is that possible?

[hayata-suenaga]

I cannot access the link. I'd appreciate it if someone could point me to the right resource 🙇

[arlbibek]

Hi @TravisC671, did you find a solution (or a workaround)? If you did can you please share it here?

[zachgoll]

Just wanted to share a solution that I came up with that is a bit simpler than setting up a separate endpoint.

You can explicitly pass values from the JSON file that Google provides to the auth client. Your setup will look something like this (with a service account + Google Analytics 4 API as an example, but replace with any Google API):

import { GoogleAuth } from 'google-auth-library' // no need to install this library, it comes with @google-analytics/data
import { BetaAnalyticsDataClient } from '@google-analytics/data'

const cli = new BetaAnalyticsDataClient({
  auth: new GoogleAuth({
      projectId: 'yourprojectid',
      scopes: 'https://www.googleapis.com/auth/analytics',
      credentials: {
        client_email: 'email from json file',
        private_key: 'pk from json file'
      })
})

// Now you can use the relevant API
cli.runReport({ ... }).then()

[UnlockingLanguage]

This was a lifesaver btw 10/10 @zachgoll

[caweidmann]

Thank you! Works like a charm.

[nuotsu]

Looks like you can include files with config.experimental.outputFileTracingIncludes per the official docs here, replacing 'api/data' with whatever route uses the file:

// next.config.js
const nextConfig = {
  experimental: {
    outputFileTracingIncludes: {
      'api/data': ['./secrets.json'],
    },
  },
}