1# Cloudflare Secrets Store
2 
3Account-level encrypted secret management for Workers and AI Gateway.
4 
5## Overview
6 
7**Secrets Store**: Centralized, account-level secrets, reusable across Workers
8**Worker Secrets**: Per-Worker secrets (`wrangler secret put`)
9 
10### Architecture
11 
12- **Store**: Container (1/account in beta)
13- **Secret**: String ≤1024 bytes
14- **Scopes**: Permission boundaries controlling access
15  - `workers`: For Workers runtime access
16  - `ai-gateway`: For AI Gateway access
17  - Secrets must have correct scope for binding to work
18- **Bindings**: Connect secrets via `env` object
19 
20**Regional Availability**: Global except China Network (unavailable)
21 
22### Access Control
23 
24- **Super Admin**: Full access
25- **Admin**: Create/edit/delete secrets, view metadata
26- **Deployer**: View metadata + bindings
27- **Reporter**: View metadata only
28 
29API Token permissions: `Account Secrets Store Edit/Read`
30 
31### Limits (Beta)
32 
33- 100 secrets/account
34- 1 store/account
35- 1024 bytes max/secret
36- Production secrets count toward limit
37 
38## When to Use
39 
40**Use Secrets Store when:**
41- Multiple Workers share same credential
42- Centralized management needed
43- Compliance requires audit trail
44- Team collaboration on secrets
45 
46**Use Worker Secrets when:**
47- Secret unique to one Worker
48- Simple single-Worker project
49- No cross-Worker sharing needed
50 
51## In This Reference
52 
53### Reading Order by Task
54 
55| Task | Start Here | Then Read |
56|------|------------|-----------|
57| Quick overview | README.md | - |
58| First-time setup | README.md → configuration.md | api.md |
59| Add secret to Worker | configuration.md | api.md |
60| Implement access pattern | api.md | patterns.md |
61| Debug errors | gotchas.md | api.md |
62| Secret rotation | patterns.md | configuration.md |
63| Best practices | gotchas.md | patterns.md |
64 
65### Files
66 
67- [configuration.md](./configuration.md) - Wrangler commands, binding config
68- [api.md](./api.md) - Binding API, get/put/delete operations
69- [patterns.md](./patterns.md) - Rotation, encryption, access control
70- [gotchas.md](./gotchas.md) - Security issues, limits, best practices
71 
72## See Also
73- [workers](../workers/) - Worker bindings integration
74- [wrangler](../wrangler/) - CLI secret management commands
75