One request to rule them all: the new Workers bulk secrets API!

Hey there, it's Shiichan! Today I found a handy little update around how you manage secrets in Workers, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on Cloudflare's Changelog, there's news that Workers now has a new bulk secrets API endpoint. You can create, update, or delete multiple secrets for your Worker in a single request.

The story so far

Until now, working with secrets basically meant handling them one at a time. So if you wanted to swap out a bunch of secrets at once, you had to fire off request after request, which was a bit of a chore for anyone pushing them in from CI/CD.

What changes

With the new bulk secrets endpoint, you can operate on many secrets in one request. The rules are simple:

• Include a secret with a value to create or update it
• Set a secret to null to delete it
• Secrets you leave out of the request are untouched

For example, this JSON creates API_KEY, updates the existing DB_PASSWORD, and deletes OLD_SECRET, all in one go.

{
  "secrets": {
    "API_KEY": { "type": "secret_text", "name": "API_KEY", "text": "my-api-key" },
    "DB_PASSWORD": { "type": "secret_text", "name": "DB_PASSWORD", "text": "my-db-password" },
    "OLD_SECRET": null
  }
}

Dive Deep

You can do the same thing from the command line by handing a JSON file to wrangler secret bulk.

npx wrangler secret bulk secrets.json

To delete a key, set its value to null in the JSON file. Just note that deletion isn't supported with .env files. And each request supports up to 100 total operations, counting creates, updates, and deletes combined.

Wrap-up

• Cloudflare added a new bulk secrets API endpoint to Workers
• One request can create, update, or delete multiple secrets (set a value to null to delete)
• wrangler secret bulk does the same thing from a JSON file
• Secrets left out of the request stay as-is, and each request allows up to 100 operations

It's a small but welcome update for Workers developers who want to manage secrets in bulk from CI/CD or scripts!