when i create a

gcp.serviceAccount.Key

, the plaintext key value is only available when the resource is created for the first time. how do i save this to the config as a secret so i can use it later?

When you say "save to the config" - what exactly do you have in mind? The output will be stored in the state file in the

privateKey

output property, and can be exported as a secret stack output if needed. Note that you may need to use

additionalSecretOutputs

to mark it as a secret so that it is stored encrypted.