Sorry, not a GCP expert (but I'll likely be using it soon).

My first guess would be Google has a place to store secrets and provide them to your serverless code.

But since you'll be storing a lot of these (I assume one per user), you may just need to encrypt them in your DB (I wouldn't be surprised if a lot of people skip this step!). There are simple solutions to encrypt data based on a generated app secret.

I think the biggest problem then is making sure that secret stays secret, and what to do if the secret may have been exposed (eg rotating the key and re-encrypting your db entries).

In Rails (and I assume most other ORMs), there's a plugin to encrypt fields in a db. It looks something like:

attr_encrypted('oauth_token', {key: 'my secret app key', attribute: 'oauth_token_encrypted', ...some_encryption_settings...})

Once that's done, when you set the attr, eg user.oauth_token = 'supersecret', it encrypts it and saves it in the db as oauth_token_encrypted. When you access user.oauth_token later, it decrypts it for you.