Secrets Store Demo

Read an account-scoped secret from Cloudflare Secrets Store without ever returning the full value - only status, length, a short preview, or a boolean match.

FeaturesCopy Anchor Link

• GET /secret/status - whether configured, length, and 2-character preview
• GET /secret/verify?expected= - compare without logging or returning the secret

API ReferenceCopy Anchor Link

GET /secret/statusCopy Anchor Link

Example RequestCopy Anchor Link

curl "https://your-worker.workers.dev/secret/status"

Success Response (configured)Copy Anchor Link

{
  "configured": true,
  "length": 12,
  "preview": "ab***"
}

Success Response (missing)Copy Anchor Link

{
  "configured": false
}

GET /secret/verifyCopy Anchor Link

Compare a candidate value to the stored secret.

expected string (required)

Example RequestCopy Anchor Link

curl "https://your-worker.workers.dev/secret/verify?expected=my-secret-value"

Success ResponseCopy Anchor Link

{
  "match": true
}

Error CodesCopy Anchor Link

• 400 - Missing or empty expected (MISSING_PARAM)

Use CasesCopy Anchor Link

• Learn Secrets Store Workers bindings safely
• Verify API keys without exposing secret values in responses
• Prototype account-scoped secret checks vs per-Worker secrets
• Teach secure secret handling patterns at the edge

LimitationsCopy Anchor Link

• Never returns the full secret value
• Requires a real Secrets Store store_id and secret name
• Bindings may need remote/dev account access locally
• Demo uses a single API_KEY binding only

DeploymentCopy Anchor Link

curl "https://your-worker.workers.dev/secret/status"

Local DevelopmentCopy Anchor Link

cd apps/experiments/secrets-store-demo
npm install
npm run dev

curl "http://localhost:8787/secret/status"

Secrets Store bindings may require a remote/dev account; unit tests mock API_KEY.get.

ConfigurationCopy Anchor Link

wrangler.json declares:

• Secrets Store secret binding API_KEY with store_id and secret_name: "demo-api-key"

Cloudflare Features UsedCopy Anchor Link

• Workers - Edge compute runtime
• Secrets Store - Account-scoped secrets