Secrets and environment variables land for Cloudflare Workers

Cloudflare is rolling out dedicated support for secrets and environment variables across both the Wrangler CLI and the Workers Dashboard. The goal is to reduce the risk that comes with deploying and maintaining serverless scripts—particularly around API key rotation, which previously could require code edits and full redeployments that risked downtime. In some cases, a developer writing a script shouldn't even need to see the actual key value.

Before building the feature, the Workers team collected feedback from community forums, social media, and a survey of existing users. Their research showed that while there was already a way to store secrets via Workers KV, it was unintuitive, didn't meet all needs, and many users weren't even aware it existed. To design a better solution, the team looked at how other Platform as a Service offerings handle similar problems.

Two kinds of variables, two tiers of access

A central design finding was that not all environment variables are equal in practice. Some are plain text a developer may want to view and edit at any point. Others carry higher stakes—an API key protecting an important system—and shouldn't be visible to everyone with dashboard access, possibly not even to the developers themselves.

To accommodate both scenarios without compromise, the release includes two distinct variable types:

  • Environment variables: stored in plain text, visible and editable in the interface.
  • Secrets: encrypted the moment they are saved and never displayed again.

Usability testing drove the final design

Cloudflare ran prototypes and rough implementations in staging environments, observing developers as they added secrets and plain-text variables, referenced them in Workers, and bound their Worker to a Worker KV namespace. They tested both the new dashboard interface and the Wrangler CLI, with users performing the same tasks in each to see whether expectations differed between graphical and command-line tooling.

Testing led to several changes before release. Small fixes included adjusting form field behavior so users could tell which variable each value would be attached to. A larger change was separating KV namespace bindings from other environment variables. In Wrangler, users were already accustomed to referencing KV namespaces via bindings; when the dashboard presented a field labeled "KV Variables," users thought they were adding keys and values to the namespace itself rather than creating a reference to it. The interface now uses the term "KV namespace binding" across the entire experience to make that distinction clear.

Available now

Environment variables and secrets are live in the Wrangler CLI and the Workers Dashboard. Cloudflare is also inviting users to participate in future user research sessions or share feedback directly by email.