Workers integration Workers integration

Cloudflare Secrets Store is a secure, centralized location in which account-level secrets are stored and managed. The secrets are securely encrypted and stored across all Cloudflare data centers.

Consider the steps below to learn how to use values from your account secrets store with Cloudflare Workers.

This is different from Workers Variables and Secrets, where you define and manage your secrets on a per-Worker level.

• If using the Dashboard, make sure you already have a Workers application. Refer to the Workers get started for guidance.
• You should also have a store created under the Secrets Store tab on the Dashboard. The first store in your account is created automatically when a user with Super Administrator or Secrets Store Admin role interacts with it.

* If no store exists in your account yet and you have the necessary permissions, you can use the Wrangler command secrets-store store create <name> --remote to create your first store.

Local development mode

This guide assumes you are working in production. To use Secrets Store locally, you must use secrets-store secret Wrangler commands without the --remote flag.

Follow the steps below to create secrets. You must have a Super Administrator or a Secrets Store Admin role within your Cloudflare account.

You may also add account secrets directly from the Workers settings on the dashboard. You can skip to step 2 to do that.

• Wrangler
• Dashboard
• API

Use the Wrangler command secrets-store secret create.

To use the following example, replace the store ID and secret name by your actual data. You can find and copy the store ID from the Secrets Store tab ↗ on the dashboard or use wrangler secrets-store store list.

Note that a secret name cannot contain spaces.

Terminal window

npx wrangler secrets-store secret create <STORE_ID> --name MY_SECRET_NAME --scopes workers --remote

✓ Enter a secret value: › ***


🔐 Creating secret... (Name: MY_SECRET_NAME, Value: REDACTED, Scopes: workers, Comment: undefined)

✓ Select an account: › My account

✅ Created secret! (ID: 13bc7498c6374a4e9d13be091c3c65f1)

1. In the Cloudflare dashboard, go to the Secrets Store page.

Go to Secrets Store

1. Select Create secret.
2. Fill in the required fields, choosing Workers as the Permission scope. Once the secret is saved, the secret value will no longer be available for viewing.
3. (Optional) Select Add additional secret to create more than one secret at a time.
4. Select Save to confirm.

You can find and copy the store ID from the Secrets Store tab ↗ on the dashboard or use the Wrangler command. Also, make sure your secret name does not contain spaces.

Refer to Secrets Store API for the full API documentation.

Required API token permissions

At least one of the following token permissionsis required:

• Secrets Store Write

Create a secret

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/secrets_store/stores/$STORE_ID/secrets" \

  --request POST \

  --header "X-Auth-Email: $CLOUDFLARE_EMAIL" \

  --header "X-Auth-Key: $CLOUDFLARE_API_KEY" \

  --json '[

    {

        "name": "<MY_SECRET_NAME>",

        "value": "<SECRET_VALUE>",

        "scopes": [

            "workers"

        ],

        "comment": ""

    },

    {

        "name": "<MY_SECRET_NAME_2>",

        "value": "<SECRET_VALUE>",

        "scopes": [

            "workers"

        ],

        "comment": ""

    }

  ]'

Refer to manage account secrets for further options.

Bindings allow your Worker to interact with resources on your Cloudflare account.

To bind an account secret to your Worker, you must have one of the following roles within your Cloudflare account:

• Super Administrator
• Secrets Store Deployer

Bindings are located on the env object. To access the secret you first need an asynchronous call.