Envlet on Cloudflare Workers

Workers have no process.env, so pass the token from your binding to load() and read the returned values.

Start free Read the docs

ENVLET_TOKENset with wrangler

Set up

Three steps. The host keeps one secret and everything else arrives at boot.

01
Create a token
Add Cloudflare Workers under Access and create a token for the environment it deploys.
ci/cloudflareci
Its own token, separate from your login.
token
envlet_•••••••• shown once
opens
one project, one environment
expires
always
02
Set one secret
wrangler secret put stores ENVLET_TOKEN as a Worker secret. Use a different token per environment in wrangler.jsonc env blocks.
Set the token
wrangler secret put ENVLET_TOKEN

Start through Envlet

Call load() with the token from env inside the handler.

Load in the handler

import { load } from "@envlet/sdk";

export default {
  async fetch(request: Request, env: { ENVLET_TOKEN: string }) {
    const values = await load({ token: env.ENVLET_TOKEN });
    return new Response(values.APP_NAME);
  },
};

What the host keeps

One secret in Cloudflare Workers. Rotate everything else in Envlet without touching the host.

Cloudflare Workers / production / environment variables1 secret

ENVLET_TOKEN	envlet_••••••••	the only secret the host keeps
DATABASE_URL	••••••••	moved to Envlet
STRIPE_KEY	••••••••	moved to Envlet
SENTRY_DSN	••••••••	moved to Envlet

Questions

Will my app start if Envlet is down?

No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.

Do I still need Cloudflare Workers's own secret store?

Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.

Also for

Stop pasting .env files.

One command. The right values for whoever runs it.

Start free