Sync your keys to Cloudflare Workers
You can now sync a project's keys to Cloudflare Workers.
To get started:
- Open your project's Integrations page and connect Cloudflare.
- Approve one or more Cloudflare accounts.
- Map each ApiVault environment to a Worker's Production secrets, Previews secrets, or Workers Builds variables.
#Choose the right target
| Target | Used by | When changes take effect |
|---|---|---|
| Production | Secrets available to the deployed Worker at runtime | The sync deploys a new Worker version |
| Previews | Secrets used by Worker Previews | Previews created after the sync |
| Build · Production | Secret variables used by Workers Builds on the production branch | The next production build; ApiVault does not start it |
| Build · Previews | Secret variables used by Workers Builds on other branches | The next preview build; ApiVault does not start it |
Build variables are available to your bundler and can be included in public client-side code. Map only the keys the build needs. Build targets start unselected, and targets unavailable for a Worker are disabled with an explanation.
Syncs run automatically when keys change, on the retry sweep, and from Sync now, which shows a full diff preview. Production secret changes are batched into a single new Worker version deployment.
#What ApiVault changes
ApiVault only modifies or deletes the secrets it created on each target. Existing secrets or bindings with the same name are reported as conflicts, and values over 5 KiB are skipped.
Connecting more accounts under the same login adds them alongside existing connections without revoking access to linked Workers, and unused OAuth grants are revoked immediately.
Audit logs and exports record the Cloudflare account, Worker, and deployed version count, and you can filter them with ?integration=cloudflare.
Learn more in the Cloudflare integration guide.