I don’t know about GAE, but you can run HTTP requests or whatever inside a runtime.exs, that is what I do to communicate with Hashicorp Vault to retrieve secrets, etc only when my node starts.

Hey I actually did sort something out a while ago.

In the application.ex start method I call a method called load_google_service_accounts. This then authenticates with Googles metadata server using the Goth package (as long as you are running on a google service such as GAE). Under the hood this uses the service account associated with the running service which it can do securely since you are on Googles infrastructure. Once authenticated you will get a token (from Goth) that you can use with the Google Secrets Manager API. You then fetch the secrets you want, and for easy access in the rest of the app you can store them in persistent_term.

  defp load_google_service_accounts() do
    # Load the secrets from Google Secrets Manager for use in relevant processes
    {:ok, %{token: token}} = Goth.Token.for_scope(@secret_manager_scope)

    {:ok, %{ payload: %{ data: secret_data }}} = GoogleApi.SecretManager.V1beta1.Connection.new(token)
    |> GoogleApi.SecretManager.V1beta1.Api.Projects.secretmanager_projects_secrets_versions_access(@google_project_id, @secret_name, "latest")

    decoded_data = secret_data |> Base.decode64! |> Jason.decode!

    :persistent_term.put(:secret_name, GoogleServiceAccountKey.new(decoded_data))
  end

Hope this helps