1# Configuration
2 
3## Wrangler Config
4 
5### Basic Binding
6 
7**wrangler.jsonc**:
8 
9```jsonc
10{
11  "secrets_store_secrets": [
12    {
13      "binding": "API_KEY",
14      "store_id": "abc123",
15      "secret_name": "stripe_api_key"
16    }
17  ]
18}
19```
20 
21**wrangler.toml** (alternative):
22 
23```toml
24[[secrets_store_secrets]]
25binding = "API_KEY"
26store_id = "abc123"
27secret_name = "stripe_api_key"
28```
29 
30Fields:
31- `binding`: Variable name for `env` access
32- `store_id`: From `wrangler secrets-store store list`
33- `secret_name`: Identifier (no spaces)
34 
35### Environment-Specific
36 
37**wrangler.jsonc**:
38 
39```jsonc
40{
41  "env": {
42    "production": {
43      "secrets_store_secrets": [
44        {
45          "binding": "API_KEY",
46          "store_id": "prod-store",
47          "secret_name": "prod_api_key"
48        }
49      ]
50    },
51    "staging": {
52      "secrets_store_secrets": [
53        {
54          "binding": "API_KEY",
55          "store_id": "staging-store",
56          "secret_name": "staging_api_key"
57        }
58      ]
59    }
60  }
61}
62```
63 
64**wrangler.toml** (alternative):
65 
66```toml
67[env.production]
68[[env.production.secrets_store_secrets]]
69binding = "API_KEY"
70store_id = "prod-store"
71secret_name = "prod_api_key"
72 
73[env.staging]
74[[env.staging.secrets_store_secrets]]
75binding = "API_KEY"
76store_id = "staging-store"
77secret_name = "staging_api_key"
78```
79 
80## Wrangler Commands
81 
82### Store Management
83 
84```bash
85wrangler secrets-store store list
86wrangler secrets-store store create my-store --remote
87wrangler secrets-store store delete <store-id> --remote
88```
89 
90### Secret Management (Production)
91 
92```bash
93# Create (interactive)
94wrangler secrets-store secret create <store-id> \
95  --name MY_SECRET --scopes workers --remote
96 
97# Create (piped)
98cat secret.txt | wrangler secrets-store secret create <store-id> \
99  --name MY_SECRET --scopes workers --remote
100 
101# List/get/update/delete
102wrangler secrets-store secret list <store-id> --remote
103wrangler secrets-store secret get <store-id> --name MY_SECRET --remote
104wrangler secrets-store secret update <store-id> --name MY_SECRET --new-value "val" --remote
105wrangler secrets-store secret delete <store-id> --name MY_SECRET --remote
106 
107# Duplicate
108wrangler secrets-store secret duplicate <store-id> \
109  --name ORIG --new-name COPY --remote
110```
111 
112### Local Development
113 
114**CRITICAL**: Production secrets (`--remote`) NOT accessible in local dev.
115 
116```bash
117# Create local-only (no --remote)
118wrangler secrets-store secret create <store-id> --name DEV_KEY --scopes workers
119 
120wrangler dev    # Uses local secrets
121wrangler deploy # Uses production secrets
122```
123 
124Best practice: Separate names for local/prod:
125 
126```jsonc
127{
128  "env": {
129    "development": {
130      "secrets_store_secrets": [
131        { "binding": "API_KEY", "store_id": "store", "secret_name": "dev_api_key" }
132      ]
133    },
134    "production": {
135      "secrets_store_secrets": [
136        { "binding": "API_KEY", "store_id": "store", "secret_name": "prod_api_key" }
137      ]
138    }
139  }
140}
141```
142 
143## Dashboard
144 
145### Creating Secrets
146 
1471. **Secrets Store** → **Create secret**
1482. Fill: Name (no spaces), Value, Scope (`Workers`), Comment
1493. **Save** (value hidden after)
150 
151### Adding Bindings
152 
153**Method 1**: Worker → Settings → Bindings → Add → Secrets Store
154**Method 2**: Create secret directly from Worker settings dropdown
155 
156Deploy options:
157- **Deploy**: Immediate 100%
158- **Save version**: Gradual rollout
159 
160## CI/CD
161 
162### GitHub Actions
163 
164```yaml
165- name: Create secret
166  env:
167    CLOUDFLARE_API_TOKEN: ${{ secrets.CF_TOKEN }}
168  run: |
169    echo "${{ secrets.API_KEY }}" | \
170    npx wrangler secrets-store secret create $STORE_ID \
171      --name API_KEY --scopes workers --remote
172 
173- name: Deploy
174  run: npx wrangler deploy
175```
176 
177### GitLab CI
178 
179```yaml
180script:
181  - echo "$API_KEY_VALUE" | npx wrangler secrets-store secret create $STORE_ID --name API_KEY --scopes workers --remote
182  - npx wrangler deploy
183```
184 
185See: [api.md](./api.md), [patterns.md](./patterns.md)
186