Cloudflare.SecretsStore reference

ReadSecret

Source: packages/cloudflare/src/SecretsStore/ReadSecret.ts

Bind a Secret to a Worker and obtain the Effect-native secret client. The client is itself an Effect that resolves to the secret’s current value.

ReadSecret is a single identifier that is simultaneously the binding’s Context tag, its type, and the callable — yield* Cloudflare.SecretsStore.ReadSecret(ApiKey).

ReadSecret: Examples

const apiKey = yield* Cloudflare.SecretsStore.ReadSecret(ApiKey);
const value = yield* apiKey;

Secret

Source: packages/cloudflare/src/SecretsStore/Secret.ts

A single secret stored inside a Cloudflare Secrets Store.

The secret value is treated as redacted and never logged. Changing value, scopes, or comment updates the secret in place (same secret ID); changing name or moving it to another store replaces it.

Secret: Creating a Secret

const store = yield* Cloudflare.SecretsStore.Store("MyStore");
const apiKey = yield* Cloudflare.SecretsStore.Secret("ApiKey", {
  store,
  value: Redacted.make(process.env.API_KEY!),
});

Secret: Binding to a Worker

const apiKey = yield* Cloudflare.SecretsStore.ReadSecret(ApiKey);
// `apiKey` is itself an Effect that resolves to the secret value:
const value = yield* apiKey;
// Or call `.get()` explicitly:
const value = yield* apiKey.get();

Secret: Looking up an existing Secret

Secret.lookup binds a secret Alchemy doesn’t manage (created in the dashboard, with wrangler or by another stack), found in a store by secretId or name. It is read during plan/deploy and never created, updated or deleted; its value never leaves Cloudflare.

const store = Cloudflare.SecretsStore.Store.lookup({
  name: "default_secrets_store",
});
const apiKey = yield* Cloudflare.SecretsStore.ReadSecret(
  Cloudflare.SecretsStore.Secret.lookup({
    storeId: store.storeId,
    name: "OPENAI_API_KEY",
  }),
);

Store

Source: packages/cloudflare/src/SecretsStore/SecretsStore.ts

A Cloudflare Secrets Store, a per-account container for secrets that can be bound into Workers with full redaction and audit support.

Cloudflare enforces a limit of one Secrets Store per account. Deleting a store changes its ID and permanently destroys all secrets inside it. Because of this, the provider always adopts an existing store rather than creating a new one, and never deletes the store on teardown. The read lifecycle reports the existing account store (if any) as plain attrs, so the engine silently adopts it on cold start and create is only ever invoked when no store exists yet. Once it exists it is treated as account-level infrastructure that outlives any single stack.

Store: Creating a Store

Basic Secrets Store (adopts existing or creates one)

const store = yield* Cloudflare.SecretsStore.Store("MyStore");

Adopt a specific named store

const store = yield* Cloudflare.SecretsStore.Store("MyStore", {
  name: "production-secrets",
});

Store: Looking up an existing Store

Store.lookup reads a store Alchemy doesn’t manage, found by storeId or name, so secrets can be looked up inside it. It is read during plan/deploy and never created or deleted.

const store = Cloudflare.SecretsStore.Store.lookup({
  name: "default_secrets_store",
});