defineSecret fails on deploy: "Only gcfv1, gcfv2 support secret environments"

[mafreud]

Related issues

• feat: add task triggers #42 (Secret Manager access)

[REQUIRED] Version info

Dart SDK:

Dart SDK version: 3.11.4 (stable) (Tue Mar 24 01:02:20 2026 -0700) on "macos_arm64"

firebase_functions (Dart package): 0.5.0

firebase_admin_sdk (Dart package): 0.5.0

firebase-tools (CLI): 15.15.0

[REQUIRED] Test case

import 'package:firebase_functions/firebase_functions.dart';

final githubWebhookSecret = defineSecret('GITHUB_WEBHOOK_SECRET');

Future<void> main(List<String> args) async {
  await fireUp(args, (firebase) {
    firebase.https.onRequest(
      (request, response) async {
        final secret = githubWebhookSecret.value();
        response.send('OK');
      },
      name: 'myFunction',
      options: HttpsOptions(
        region: const DeployOption(SupportedRegion.asiaNortheast1),
        secrets: [githubWebhookSecret],
      ),
    );
  });
}

[REQUIRED] Steps to reproduce

1. Create a Dart Firebase Function using firebase_functions: ^0.5.0
2. Define a secret using defineSecret('SECRET_NAME')
3. Pass it to the secrets parameter in HttpsOptions or CallableOptions
4. Run firebase deploy --only functions:dart

[REQUIRED] Expected behavior

The secret should be mounted as an environment variable on the Cloud Run service (similar to how it works for GCFv2 TypeScript functions), and the function should deploy successfully.

The firebase_functions Dart SDK already exposes defineSecret(), SecretParam, and the secrets option in HttpsOptions / CallableOptions, so the API surface implies this should work.

[REQUIRED] Actual behavior

Deployment fails with the following error:

Error: Tried to set secret environment variables on my-function[platform=run]. Only gcfv1, gcfv2 support secret environments.

The Firebase CLI recognizes the secret definitions from the compiled Dart spec but rejects them because Dart functions are deployed as Cloud Run services (platform=run), and the CLI's secret environment variable support is only implemented for gcfv1 and gcfv2 platforms.

Were you able to successfully deploy your functions?

No. Deployment fails at the validation step before any Cloud Run service is created or updated.

Workaround: Access Secret Manager directly at runtime using the REST API (bypassing defineSecret entirely). This works but loses the benefits of declarative secret management (automatic IAM binding, deploy-time validation, etc.).

[demolaf]

Hi @mafreud , thanks for raising this issue. I've been able to reproduce this and working on a potential fix.

I've opened a PR to fix the issue on the firebase-tools repo firebase/firebase-tools#10489 and also another bug found while testing on firebase_functions SDK #180.

[mafreud]

@demolaf merged and released. Thanks! @demolaf