public byte[] decryptAppSecret(byte[] ciphertext) throws IOException {
    DecryptRequest request = new DecryptRequest().encodeCiphertext(ciphertext);
    DecryptResponse response =
        cloudKMS
            .projects()
            .locations()
            .keyRings()
            .cryptoKeys()
            .decrypt(secretsCryptoKey, request)
            .execute();

    return response.decodePlaintext();
  }
Decrypts app secrets using Google Cloud KMS.
extensions/cloud/portability-cloud-google/src/main/java/org/datatransferproject/cloud/google/GoogleAppSecretDecrypter.java