# Secrets Store Demo (/docs/experiments/secrets-store-demo)



Read an account-scoped secret from [Cloudflare Secrets Store](https://developers.cloudflare.com/secrets-store/) without ever returning the full value - only status, length, a short preview, or a boolean match.

## Features [#features]

* `GET /secret/status` - whether configured, length, and 2-character preview
* `GET /secret/verify?expected=` - compare without logging or returning the secret

## API Reference [#api-reference]

### GET /secret/status [#get-secretstatus]

#### Example Request [#example-request]

```bash
curl "https://your-worker.workers.dev/secret/status"
```

#### Success Response (configured) [#success-response-configured]

```json
{
  "configured": true,
  "length": 12,
  "preview": "ab***"
}
```

#### Success Response (missing) [#success-response-missing]

```json
{
  "configured": false
}
```

### GET /secret/verify [#get-secretverify]

Compare a candidate value to the stored secret.

**`expected`** `string` (required)

#### Example Request [#example-request-1]

```bash
curl "https://your-worker.workers.dev/secret/verify?expected=my-secret-value"
```

#### Success Response [#success-response]

```json
{
  "match": true
}
```

#### Error Codes [#error-codes]

* `400` - Missing or empty `expected` (`MISSING_PARAM`)

## Use Cases [#use-cases]

* Learn Secrets Store Workers bindings safely
* Verify API keys without exposing secret values in responses
* Prototype account-scoped secret checks vs per-Worker secrets
* Teach secure secret handling patterns at the edge

## Limitations [#limitations]

* Never returns the full secret value
* Requires a real Secrets Store `store_id` and secret name
* Bindings may need remote/dev account access locally
* Demo uses a single `API_KEY` binding only

## Deployment [#deployment]

<Steps>
  <Step>
    ### Click the deploy button [#click-the-deploy-button]

    [![Deploy to Cloudflare Workers](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/shrinathsnayak/cloudflare-experiments/tree/main/apps/experiments/secrets-store-demo)
  </Step>

  <Step>
    ### Configure Secrets Store [#configure-secrets-store]

    1. Create a Secrets Store and a secret named `demo-api-key`
    2. Set `store_id` in `wrangler.json` under `secrets_store_secrets` for binding `API_KEY`
  </Step>

  <Step>
    ### Test your deployment [#test-your-deployment]

    ```bash
    curl "https://your-worker.workers.dev/secret/status"
    ```
  </Step>
</Steps>

## Local Development [#local-development]

```bash
cd apps/experiments/secrets-store-demo
npm install
npm run dev
```

```bash
curl "http://localhost:8787/secret/status"
```

Secrets Store bindings may require a remote/dev account; unit tests mock `API_KEY.get`.

## Configuration [#configuration]

`wrangler.json` declares:

* **Secrets Store secret** binding `API_KEY` with `store_id` and `secret_name: "demo-api-key"`

## Cloudflare Features Used [#cloudflare-features-used]

* **[Workers](https://developers.cloudflare.com/workers/)** - Edge compute runtime
* **[Secrets Store](https://developers.cloudflare.com/secrets-store/)** - Account-scoped secrets