Retrieve secrets from environment variable
Secrets stored using wrangler secret put can be accessed in Worker code via the env object using the secret name as the property, for example env.SECRET_NAME returns the secret value.
Cloudflare Workers · Wrangler · all subjects
secrets
27 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Use wrangler secret put to store API authentication credentials
To securely store API credentials for third-party services, use the wrangler secret put command to create a secret in your Cloudflare Workers project. The command syntax is: wrangler secret put SECRET_NAME. You will be prompted to enter the secret value.
Retrieve secret values in Worker code using env object
To access a secret that was stored with wrangler secret put, retrieve it in your Worker code using the env object: const secretValue = env.SECRET_NAME;
Add secrets via Cloudflare dashboard
To add a secret via the Cloudflare dashboard: 1. Go to the Workers & Pages page. 2. In Overview, select your Worker > Settings. 3. Under Variables and Secrets, select Add. 4. Select the type Secret, input a Variable name, and input its Value. The value will be hidden in Wrangler and the dashboard. 5. Optionally, add more secrets by selecting Add variable. 6. Select Deploy to implement your changes.
Delete secrets via Cloudflare dashboard
To delete a secret from your Worker project via the Cloudflare dashboard: 1. Go to the Workers & Pages page. 2. In Overview, select your Worker > Settings. 3. Under Variables and Secrets, select Edit. 4. In the Edit drawer, select X next to the secret you want to delete. 5. Select Deploy to implement your changes. Alternatively, you can click the delete icon next to the secret.
Secrets Store is account-level alternative
Secrets described in this documentation are defined and managed on a per-Worker level. For account-level secrets, refer to Secrets Store, which are configured on your Worker as a Secrets Store binding.
Secrets Store --remote flag requirement
To interact with Secrets Store in production, append the --remote flag to commands. Without --remote, commands default to local development mode.
Secrets Store beta limitation
Secrets Store is in open beta and currently allows only one store per Cloudflare account.
secrets-store secret create example
Example: `npx wrangler secrets-store secret create 8f7a1cdced6342c18d223ece462fd88d --name ServiceA_key-1 --scopes workers --remote`. This creates a secret named 'ServiceA_key-1' with 'workers' scope in the specified store.
secrets-store secret get example
Example: `npx wrangler secrets-store secret get 8f7a1cdced6342c18d223ece462fd88d --secret-id 13bc7498c6374a4e9d13be091c3c65f1 --remote`. This retrieves a secret by its ID and displays information including Name, ID, StoreID, Comment, Scopes, Status, Created, and Modified timestamps.
secrets-store store create example
Example: `npx wrangler secrets-store store create default --remote`. This creates a store named 'default' and returns the store ID.
secrets-store store delete example
Example: `npx wrangler secrets-store store delete d2dafaeac9434de2b6d08b292ce08211 --remote`. This deletes a store by its ID.
secrets-store store list example
Example: `npx wrangler secrets-store store list --remote`. This lists all stores and returns a table with columns: Name, ID, AccountID, Created, and Modified.
secrets configuration field
The secrets field is an optional non-inheritable object that declares the secret names the Worker requires. Used for validation during local development and deploy, and as the source of truth for type generation. Contains: required (optional string array) - A list of secret names that must be set to deploy the Worker.
secrets_store_secrets binding configuration
The secrets_store_secrets field is an optional non-inheritable object that specifies a list of Secrets Store bindings the Worker should be bound to.
Secrets configuration property
The secrets configuration property has a required field that is an array of secret names. When secrets is defined at any config level, wrangler types generates typed bindings from the names in secrets.required and no longer infers secret names from .dev.vars or .env files. During deploy, wrangler deploy and wrangler versions upload validate that all secrets in secrets.required are configured on the Worker before the operation succeeds.
Set environment-specific secrets with wrangler secret put
Environment-specific secrets can be assigned by running 'wrangler secret put <KEY> -env'. Alternatively, create dotenv type files named '.dev.vars.<environment-name>'. Secrets are non-inheritable and must be defined per environment.
Wrangler v1 Global API Key security
The Global API Key should be treated like a password and should not be stored in version control or in your code; use environment variables if possible.
wrangler secret put command
The `wrangler secret put` command creates or replaces a secret. Syntax: `wrangler secret put <name> --env ENVIRONMENT_NAME`. Parameter: `<name>` is the variable name accessible in the script. Flag `--env $ENVIRONMENT_NAME` applies to specified environment. The command prompts for the secret value or accepts piped input (e.g., `echo "value" | wrangler secret put SECRET_NAME`).
wrangler secret delete command
The `wrangler secret delete` command deletes a secret from a script. Syntax: `wrangler secret delete <name> --env ENVIRONMENT_NAME`. Parameter: `<name>` is the variable name. Flag `--env $ENVIRONMENT_NAME` applies to specified environment.
wrangler secret list command
The `wrangler secret list` command lists all secret names bound to a script. Syntax: `wrangler secret list --env ENVIRONMENT_NAME`. Flag `--env $ENVIRONMENT_NAME` lists only specified environment's secrets.
Secrets must not appear in config files
Secrets must never appear in wrangler configuration files. They are set via wrangler secret put. If a vars block contains values that look like secrets such as API keys, tokens, or passwords, this should be flagged as an error.
wrangler secret list command shows all secrets
The `wrangler secret list` command lists all secrets for the current Worker. It returns a JSON array containing objects with `name` and `type` fields for each secret (e.g., type: 'secret_text').
wrangler secret put command adds a secret
The `wrangler secret put` command adds a new secret for a Worker. When running this command, you are prompted to input the secret's value interactively. The command can also receive piped input for non-interactive use. This action creates a new version of the Worker and deploys it immediately. To only create a new version without deploying, use `wrangler versions secret` commands instead.
wrangler secret delete command removes a secret
The `wrangler secret delete` command removes an existing secret from a Worker. This action creates a new version of the Worker and deploys it immediately.
wrangler secret bulk command manages multiple secrets
The `wrangler secret bulk` command creates, updates, or deletes multiple secrets for a Worker in a single request, with up to 100 secrets per command. The command accepts JSON or .env format input. To delete a secret, set its key to `null` in JSON format (requires wrangler version 4.97.0 or later; deletion not supported with .env files). Existing secrets not included in the file are preserved from the previous version.
wrangler secret bulk example with JSON format
Example JSON format for wrangler secret bulk command: ```json { "secret-name-1": "secret-value-1", "secret-name-2": "secret-value-2", "secret-name-3": null } ``` Pipe this to `npx wrangler secret bulk < secrets.json`. Setting a key to `null` deletes that secret (requires wrangler 4.97.0 or later).