Save API keys as secrets
Keep API keys outside your code and read them as env vars.
Your app reads API keys as Worker env vars (like env.MY_KEY). Set them outside the code so they never ship in a file. The next pages cover who can see your app, the content rules, and your data.
- Open your app in the Console → Secrets.
- Add the secret with its name and value.
- Ask your agent to deploy so the running app picks it up.
| Rule | Value |
|---|---|
| Name shape | ^[A-Z_][A-Z0-9_]{0,63}$ |
| Value size | At most 4 KiB |
| Count | At most 50 per app |
| Timing | Applies on the next deploy; setting one never touches the running fleet |
Your agent can also set them with set_secret and remove them with unset_secret. Values are never shown again after saving, not even to you. How agents use them: Store API keys as secrets.