Secrets Store Demo

Read an account-scoped secret from Cloudflare Secrets Store without ever returning the full value - only status, length, a short preview, or a boolean match.

FeaturesCopy Anchor Link

• GET /secret/status - whether configured, length, and 2-character preview
• GET /secret/verify?expected= - compare without logging or returning the secret

API ReferenceCopy Anchor Link

GET /secret/statusCopy Anchor Link

Example RequestCopy Anchor Link

curl "https://your-worker.workers.dev/secret/status"

Success Response (configured)Copy Anchor Link

{
  "configured": true,
  "length": 12,
  "preview": "ab***"
}

Success Response (missing)Copy Anchor Link

{
  "configured": false
}

GET /secret/verifyCopy Anchor Link

Compare a candidate value to the stored secret.

expected string (required)

Example RequestCopy Anchor Link

curl "https://your-worker.workers.dev/secret/verify?expected=my-secret-value"

Success ResponseCopy Anchor Link

{
  "match": true
}

Error CodesCopy Anchor Link

• 400 - Missing or empty expected (MISSING_PARAM)

Use CasesCopy Anchor Link

• Learn Secrets Store Workers bindings safely
• Verify API keys without exposing secret values in responses
• Prototype account-scoped secret checks vs per-Worker secrets
• Teach secure secret handling patterns at the edge

LimitationsCopy Anchor Link

• Never returns the full secret value
• Requires a real Secrets Store store_id and secret name
• Bindings may need remote/dev account access locally
• Demo uses a single API_KEY binding only

Use in your projectCopy Anchor Link

import type { SecretsStoreSecret } from "../types/env";import type { SecretStatus } from "../types/secret";/** Never log or return the full secret. */export function previewSecret(value: string): string {  if (value.length === 0) return "***";  if (value.length === 1) return `${value}***`;  return `${value.slice(0, 2)}***`;}export async function readSecretStatus(  binding: SecretsStoreSecret | undefined): Promise<SecretStatus> {  if (!binding || typeof binding.get !== "function") {    return { configured: false };  }  try {    const value = await binding.get();    if (typeof value !== "string") {      return { configured: false };    }    return {      configured: true,      length: value.length,      preview: previewSecret(value),    };  } catch {    return { configured: false };  }}export async function verifySecret(  binding: SecretsStoreSecret | undefined,  expected: string): Promise<boolean> {  if (!binding || typeof binding.get !== "function") {    return false;  }  try {    const value = await binding.get();    return value === expected;  } catch {    return false;  }}

DeploymentCopy Anchor Link

curl "https://your-worker.workers.dev/secret/status"

Local DevelopmentCopy Anchor Link

cd apps/experiments/secrets-store-demo
npm install
npm run dev

curl "http://localhost:8787/secret/status"

Secrets Store bindings may require a remote/dev account; unit tests mock API_KEY.get.

ConfigurationCopy Anchor Link

wrangler.json declares:

• Secrets Store secret binding API_KEY with store_id and secret_name: "demo-api-key"

Cloudflare Features UsedCopy Anchor Link

• Workers - Edge compute runtime
• Secrets Store - Account-scoped secrets