1.8 KiB
Secrets Store APIs
Fetch the current API documentation before implementing calls or copying types.
| Task | Documentation |
|---|---|
| Read a bound account secret asynchronously in a Worker | Workers integration: access the secret |
| Generate binding and runtime types for the Worker configuration | Workers TypeScript |
| Manage stores and secrets, inspect metadata, or query quota | Secrets Store REST API |
| Choose authorization and consuming-service scope | Access control |
| Manage secrets through the CLI instead of REST | Wrangler Secrets Store commands |
Runtime decisions
Account-secret bindings require asynchronous retrieval; they are not the direct string values exposed by Worker secrets. Account management APIs and metadata reads are separate from consuming a bound secret in a Worker.
Handle retrieval failures at the application's error boundary without exposing credentials. Reuse a retrieved value within the request when useful; avoid long-lived application caches that could keep revoked credentials in use. Validate structured secret values against the application's schema before using them.
Never return a credential to a client or include it in logs, error messages, or telemetry. Record only the non-sensitive context needed to diagnose a failure.
See configuration.md for setup and gotchas.md for access failures.