Routing and configuration
Separate variables and secrets
Put ordinary environment configuration in versioned vars and sensitive values in the Cloudflare secret store.
8 minute lesson
Not every setting is a secret. Public environment names and feature choices can live in configuration; credentials must not.
Access both through env, but create secrets with Wrangler or the dashboard so plaintext never enters Git. Configure each environment separately because bindings and secret values may not inherit the way you expect.
npx wrangler secret put API_TOKEN
npx wrangler secret listClassify by impact, not by convenience. A feature flag or public environment name is a variable; an API token, signing key, or private endpoint credential is a secret. Both arrive through env, but only ordinary configuration belongs in version control.
Use separate credentials with the smallest permissions for each environment. Rotation means adding the new credential, deploying code that reads it, verifying the dependent path, and revoking the old credential. A deployment rollback can reactivate older code, so check that the rollback version does not require a revoked secret. Logs, exceptions, response bodies, and local environment files are all possible leak paths even when Git is clean.
Add a non-secret ENVIRONMENT variable and a practice secret, then confirm code can read them without printing the secret.
Lesson completed