How to add a secret to a Cloudflare Worker
Store an API key for a Worker so it never sits in code, chat or a browser tab.
A Worker Secret is a value Cloudflare stores encrypted and exposes to one Worker as an environment variable. You write it once; afterwards nobody, including you, can read it back from the dashboard. This is how seops itself keeps every provider key, and how you should keep keys in your own Workers.
What opens in seops
- Keys stay out of code, commits, chat logs and browser tabs
- Rotating a key is re-adding it under the same name
- Works the same from the dashboard and from
wrangler secret put
Steps
-
Open the Worker's settings
In the Cloudflare dashboard go to Workers & Pages, pick the Worker, then Settings.
-
Find Variables and Secrets
Scroll to Variables and Secrets and click + Add.
-
Choose the type Secret
Set Type to Secret. In Variable name type the name your code reads (for example
BING_WEBMASTER_API_KEY); paste the value in Value. -
Deploy
Click Deploy. The Worker sees the secret within seconds. From a terminal the same thing is
wrangler secret put BING_WEBMASTER_API_KEY.wrangler secret put BING_WEBMASTER_API_KEY
How to use it in seops
- Read it in the Worker as
env.BING_WEBMASTER_API_KEY - Never log it; mask it if you must show that it exists (seops shows only the last 4 characters)
Questions
I typed the wrong value
Add it again under the same name; the new value replaces the old one on the next deploy.
Secret or plain variable?
Anything that grants access (API keys, tokens, passwords) is a Secret. Settings that are fine to read back (a region, a feature flag) can be plain variables.