Cloudflare Pages & Workers: Encrypted Secrets

​

Pages (framework build)

1. Add Capy CLI as a dep so Cloudflare installs it during build:
   bun add -D @capysc/cli
   
2. Wrap the framework build command in your Pages project’s Build command setting (Cloudflare dashboard → Pages → Settings → Builds & deployments):
   capy run -- <framework build>
   
   Examples:
   • Next.js: capy run -- bunx @cloudflare/next-on-pages
   • SvelteKit: capy run -- bun run build
   • Astro: capy run -- bun run build
3. Mint the two build vars. Run capy deploy, pick Cloudflare Pages, then choose Set up CI deploy token + docs (or skip both prompts with capy deploy --platform cloudflare-pages --mode token). Capy hands you SECRETS_BLOB and PROJECT_KEY; set both as Pages environment variables (Settings → Environment Variables), per environment (Production / Preview).
4. Point your framework’s env config at the generated map. For Next on Pages this is next.config.js’s env field (same as the Vercel flow). For SvelteKit use $env/static/private. For Astro use import.meta.env. capy run emits .capy/next-env.js for Next; other frameworks read process.env during the build and inline via their own mechanism.
5. Deploy. Cloudflare runs your build command (wrapped by capy run), decrypts during build, inlines values, ships the bundle. Workers and Pages functions read the inlined constants at request time.

​

Workers (wrangler-only projects)

capy deploy    # pick Cloudflare Workers → "Deploy now via connector"

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const db = env.DATABASE_URL;   // populated from Worker secret store
    // ...
  }
};

​

By hand

capy run -- node -e '
  const names = ["DATABASE_URL", "STRIPE_SECRET_KEY"];  // what your Worker reads
  const out = {};
  for (const n of names) if (process.env[n]) out[n] = process.env[n];
  console.log(JSON.stringify(out));
' | wrangler secret bulk

wrangler deploy

// package.json
{
  "scripts": {
    "deploy": "capy run -- ./scripts/deploy-worker.sh"
  }
}

#!/usr/bin/env bash
# scripts/deploy-worker.sh
set -euo pipefail

node -e '
  const names = ["DATABASE_URL", "STRIPE_SECRET_KEY"];  // what your Worker reads
  const out = {};
  for (const n of names) if (process.env[n]) out[n] = process.env[n];
  console.log(JSON.stringify(out));
' | wrangler secret bulk

wrangler deploy

​

Why the two paths differ

• Pages: the framework adapter generates a server bundle during build. Your framework’s env config inlines decrypted values as string literals. Runtime reads literals - no runtime crypto, nothing in CF’s secret store.
• Workers: no framework build to hook into. Decryption still happens on your machine - by the cf-worker connector, or by capy run if you script it yourself - but the results land in CF’s Worker secret store. The Worker reads them via env.X.

​

Revocation

• Pages: a revoked deploy token fails the next Pages build - capy run can no longer fetch the service key. Already-deployed bundles keep their inlined values until you redeploy.
• Workers: the values are already plaintext in Cloudflare’s store, so revoking a deploy token doesn’t reach them and the Worker keeps serving. To purge, delete each secret (wrangler secret delete <NAME>) or overwrite them with a fresh push. If your Worker deploy runs in CI off SECRETS_BLOB, revoking does stop the next CI run from decrypting.