ZeroVault with Cloudflare Workers

Keep a Worker’s secrets in ZeroVault and push them to Cloudflare at deploy time. You pull them with the CLI and hand the result to wrangler.

Push secrets at deploy time

Download the environment as JSON and pipe it into wrangler secret bulk:

zv secrets download -p demo -e production -f json -o secrets.json
npx wrangler secret bulk secrets.json
rm secrets.json

zv secrets download -f json emits a flat { "KEY": "VALUE" } object, which is exactly the shape wrangler secret bulk reads. Delete the file afterward; it holds plaintext secrets.

Fail the deploy when a secret is missing

Wrangler can refuse to deploy a Worker if a required secret is not set. Add the names to secrets.required in wrangler.jsonc:

{
  "name": "my-worker",
  "secrets": {
    "required": ["API_TOKEN"]
  }
}

With this in place, wrangler deploy aborts if API_TOKEN is unset, and wrangler dev warns.