sync-cf-workers-secret

Sync .env values to Cloudflare Workers secrets in one command. A tiny CLI and Node.js API that wraps wrangler secret bulk: pick the keys you want, and it uploads only the ones present in your .env file — handy as the last step of a deploy script or CI/CD pipeline (GitHub Actions, etc.), and for multi-environment setups (staging, preview, production) where each environment needs different values under the same secret name.

Why

Worker secrets (AUTH_SECRET, DATABASE_URL, …) live on Cloudflare, not in your code, so deploying a Worker does not update them. Running wrangler secret put once per secret is tedious and easy to forget once you have more than a handful. sync-cf-workers-secret turns that into one line, and handles two things wrangler doesn't do for you:

1. Missing values are skipped, not fatal. If a key is absent from .env (e.g. on a local machine), it prints a warning to stderr and moves on. If nothing is left to sync, it exits with code 0 so your deploy script keeps going.
2. Rename on the way in (TARGET=SOURCE). Upload the .env value SOURCE under the secret name TARGET. Your Worker code reads one name, while each environment feeds it a different value.

Install

npm install -D sync-cf-workers-secret
# or
pnpm add -D sync-cf-workers-secret

Requirements:

• Node.js 20.12+ (uses util.parseEnv)
• wrangler available through npx, and logged in (wrangler login or CLOUDFLARE_API_TOKEN)

Usage

# Upload AUTH_SECRET and DATABASE_URL from .env as secrets with the same names
sync-cf-workers-secret --env .env AUTH_SECRET DATABASE_URL

# Target a wrangler environment (runs `wrangler secret bulk --env staging`)
sync-cf-workers-secret --env .env --wrangler-env staging AUTH_SECRET API_KEY

# Rename: upload the .env value STAGING_DATABASE_URL as the secret DATABASE_URL
sync-cf-workers-secret --env .env --wrangler-env staging \
  DATABASE_URL=STAGING_DATABASE_URL API_KEY

As a deploy step in package.json:

{
  "scripts": {
    "deploy": "wrangler deploy && pnpm sync-secrets",
    "sync-secrets": "sync-cf-workers-secret --env .env AUTH_SECRET DATABASE_URL"
  }
}

Arguments

| Form | Meaning | | --- | --- | | KEY | Upload the .env value KEY as the secret KEY | | TARGET=SOURCE | Upload the .env value SOURCE as the secret TARGET |

Options

| Option | Description | | --- | --- | | -e, --env <path> | Path to the .env file (default: .env) | | --wrangler-env <name> | Passed to wrangler secret bulk --env <name> to target that environment's Worker | | -h, --help | Show help |

⚠️ -e/--env is the path to your .env file, not a wrangler environment. Because wrangler's own -e means "environment", the wrangler environment is accepted only through the separate --wrangler-env flag.

API

import { syncSecrets } from "sync-cf-workers-secret";

syncSecrets(".env", {
  keys: ["AUTH_SECRET", "DATABASE_URL=STAGING_DATABASE_URL"],
  wranglerEnv: "staging", // optional
});

type SyncSecretsInput = { keys: string[]; wranglerEnv?: string };
function syncSecrets(envPath: string, input: SyncSecretsInput): void;

syncSecrets runs synchronously and calls process.exit when there is nothing to sync (code 0) or when wrangler fails (wrangler's exit code).

How it works

• Reads .env with Node's built-in util.parseEnv — no dotenv dependency.
• Writes the collected values to a temporary JSON file (mode 0600, in os.tmpdir()), runs npx wrangler secret bulk <file>, and deletes the file afterwards, even on failure.
• If the .env file itself is missing, it warns and exits with code 0.

License

MIT