Cloudflare.SecretsStore reference

ReadSecret

Source: src/Cloudflare/SecretsStore/ReadSecret.ts

Bind a Secret to a Worker and obtain the Effect-native secret client. The client is itself an Effect that resolves to the secret’s current value.

ReadSecret is a single identifier that is simultaneously the binding’s Context tag, its type, and the callable — yield* Cloudflare.SecretsStore.ReadSecret(ApiKey).

ReadSecret: Examples

const apiKey = yield* Cloudflare.SecretsStore.ReadSecret(ApiKey);
const value = yield* apiKey;

Secret

Source: src/Cloudflare/SecretsStore/Secret.ts

A single secret stored inside a Cloudflare Secrets Store.

The secret value is treated as redacted and is only ever sent to Cloudflare at create time. Updating scopes or comment issues a PATCH; changing value or name replaces the secret.

Secret: Creating a Secret

const store = yield* Cloudflare.SecretsStore.Store("MyStore");
const apiKey = yield* Cloudflare.SecretsStore.Secret("ApiKey", {
  store,
  value: Redacted.make(process.env.API_KEY!),
});

Secret: Binding to a Worker

const apiKey = yield* Cloudflare.SecretsStore.ReadSecret(ApiKey);
// `apiKey` is itself an Effect that resolves to the secret value:
const value = yield* apiKey;
// Or call `.get()` explicitly:
const value = yield* apiKey.get();

Store

Source: src/Cloudflare/SecretsStore/SecretsStore.ts

A Cloudflare Secrets Store, a per-account container for secrets that can be bound into Workers with full redaction and audit support.

Cloudflare enforces a limit of one Secrets Store per account. Deleting a store changes its ID and permanently destroys all secrets inside it. Because of this, the provider always adopts an existing store rather than creating a new one, and never deletes the store on teardown. The read lifecycle reports the existing account store (if any) as plain attrs, so the engine silently adopts it on cold start and create is only ever invoked when no store exists yet. Once it exists it is treated as account-level infrastructure that outlives any single stack.

Store: Creating a Store

Basic Secrets Store (adopts existing or creates one)

const store = yield* Cloudflare.SecretsStore.Store("MyStore");

Adopt a specific named store

const store = yield* Cloudflare.SecretsStore.Store("MyStore", {
  name: "production-secrets",
});