Skip to content
Zero Docs

ZeroVault with Cloudflare Workers

Cloudflare Workers are one platform among others. To load secrets into a plain process or a CI job, see Loading secrets. This page covers pushing an environment to a Worker at deploy time: you pull the secrets with the CLI and hand the result to wrangler.

Push secrets at deploy time

Section titled “Push secrets at deploy time”

Download the environment as JSON and pipe it into wrangler secret bulk:

Terminal window
zero vault secrets download -p demo -e production -f json -o secrets.json
npx wrangler secret bulk secrets.json
rm secrets.json

zero vault secrets download -f json emits a flat { "KEY": "VALUE" } object, which is exactly the shape wrangler secret bulk reads. Delete the file afterward; it holds plaintext secrets.

Fail the deploy when a secret is missing

Section titled “Fail the deploy when a secret is missing”

Wrangler can refuse to deploy a Worker if a required secret is not set. Add the names to secrets.required in wrangler.jsonc:

{
  "name": "my-worker",
  "secrets": {
    "required": ["API_TOKEN"]
  }
}

With this in place, wrangler deploy aborts if API_TOKEN is unset, and wrangler dev warns.