Cloudflare launches a centralized secrets store
Cloudflare has announced Secrets Store, a new account-level offering for managing sensitive data like API tokens, authorization headers, and shared secrets across its services. The product is designed to close the gap between developer velocity and security oversight, giving teams a single repository for credentials that can be referenced by multiple Workers, WAF rules, and other Cloudflare services — but remain opaque to anyone without explicit permission.
Secrets are variables containing sensitive information that only authorized users and systems should be able to read or modify. Poorly stored tokens can lead to unauthorized database reads or writes, and every gap in secret storage introduces the potential for a data leak or compromise. Cloudflare's bet is that the best way to address this is to make secure secret handling as frictionless as possible inside its own platform.
Why a centralized store
Cloudflare already shipped environment variables and secrets for Workers back in 2020, letting customers encrypt variables across Worker scripts so values are not exposed in plaintext. Usage has grown quickly — the company reports more than three million Worker scripts now reference variables and secrets managed through Cloudflare. But customer feedback has been consistent: those secrets are scoped too narrowly.
Today a secret can only be used by the Worker it is associated with. Customers with credentials shared across many Workers are forced to re-create the same value in multiple places and keep them in sync manually. They want account-level secrets, managed once and referenced from anywhere.
The WAF is another obvious pain point. When building WAF rules that inspect authorization headers, customers today paste the header value in plaintext, making it visible to anyone with account access to the WAF. With a centralized store, an engineer can write a rule referencing something like account.mysecretauth instead, and only authorized users can view, rotate, or otherwise touch the underlying value.
Cloudflare also expects the store to become the natural home for Access Service tokens and shared Webhook secrets, among other uses, as new products come online.
Security and audit controls
Secrets Store ships with scope permissions that let admins restrict who can view, create, edit, or remove secrets. The company also plans to extend the same granularity to services — for example, allowing customers to state that only a specific Worker may access one secret while only a given set of Firewall rules may access another.
Audits and key rotation
Extensive audit logs will be available for every secret-related event. These logs are intended to give security teams visibility into which users are making changes and which services are accessing secrets and when — useful for detecting unauthorized access or noticing early signs of a compromised secret being used.
In addition to the store’s built-in protections, Cloudflare will provide tools for rotating encryption keys on demand or on a cadence aligned with an organization’s security posture.
