Cloudflare Workers sync

Learn how to configure a Cloudflare Workers Sync for Infisical.

Prerequisites:

• Set up and add secrets to Infisical Cloud
• Create a Cloudflare Connection

Infisical UI

1. Navigate to Project > Integrations and select the Secret Syncs tab. Select the Add Sync button.

   

2. Select the Cloudflare Workers option.

   

3. Configure the Source from where secrets should be retrieved, then click Next.

   

• Environment: The project environment to retrieve secrets from.
• Secret Path: The folder path to retrieve secrets from.

If you need to sync secrets from multiple folder locations, check out secret imports.

4. Configure the Destination to where secrets should be deployed, then click Next.

• Cloudflare Connection: The Cloudflare Connection to authenticate with.
• Cloudflare Workers Script: Choose the Cloudflare Workers script you want to sync secrets to.

5. Configure the Sync Options to specify how secrets should be synced, then click Next.

• Initial Sync Behavior: Determines how Infisical should resolve the initial sync.
  • Overwrite Destination Secrets: Removes any secrets at the destination endpoint not present in Infisical.
• Key Schema: Template that determines how secret names are transformed when syncing, using {{secretKey}} as a placeholder for the original secret name and {{environment}} for the environment.
• Auto-Sync Enabled: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
• Disable Secret Deletion: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
• Variable type: How Cloudflare stores each synced secret
  • Secret: Encrypted, so you can’t read the value in the Cloudflare dashboard
  • Text: Plain text that you can read in the Cloudflare dashboard
  • JSON: A JSON value that your Worker receives already parsed (each secret value must be valid JSON)

If a secret already exists on the Worker as a different type, the sync fails with an error that names it, and nothing on the Worker changes. To sync it, delete the variable in Cloudflare or change the sync’s variable type. With Sync plaintext and JSON variables turned on, a Secret sync updates existing text and JSON variables as they are instead. Syncs created before the variable type option existed skip those secrets rather than failing.

6. Configure the Details of your Cloudflare Workers Sync, then click Next.

• Name: The name of your sync. Must be slug-friendly.
• Description: An optional description for your sync.

7. Review your Cloudflare Workers Sync configuration, then click Create Sync.

   

8. If enabled, your Cloudflare Workers Sync will begin syncing your secrets to the destination endpoint.

   

API

To create a Cloudflare Workers Sync, make an API request to the Create Cloudflare Workers Sync API endpoint.

​

Sample request

Request

curl --request POST \
  --url https://app.infisical.com/api/v1/secret-syncs/cloudflare-workers \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "my-cloudflare-workers-sync",
    "projectId": "your-project-id",
    "description": "an example sync",
    "connectionId": "your-cloudflare-connection-id",
    "environment": "production",
    "secretPath": "/my-secrets",
    "isEnabled": true,
    "syncOptions": {
      "initialSyncBehavior": "overwrite-destination"
    },
    "destinationConfig": {
      "scriptId": "my-workers-script"
    }
  }'

​

Sample response

Response

{
  "secretSync": {
    "id": "your-sync-id",
    "name": "my-cloudflare-workers-sync",
    "description": "an example sync",
    "isEnabled": true,
    "version": 1,
    "folderId": "your-folder-id",
    "connectionId": "your-cloudflare-connection-id",
    "createdAt": "2024-05-01T12:00:00Z",
    "updatedAt": "2024-05-01T12:00:00Z",
    "syncStatus": "succeeded",
    "lastSyncJobId": "123",
    "lastSyncMessage": null,
    "lastSyncedAt": "2024-05-01T12:00:00Z",
    "syncOptions": {
      "initialSyncBehavior": "overwrite-destination"
    },
    "projectId": "your-project-id",
    "connection": {
      "app": "cloudflare",
      "name": "my-cloudflare-connection",
      "id": "your-cloudflare-connection-id"
    },
    "environment": {
      "slug": "production",
      "name": "Production",
      "id": "your-env-id"
    },
    "folder": {
      "id": "your-folder-id",
      "path": "/my-secrets"
    },
    "destination": "cloudflare-workers",
    "destinationConfig": {
      "scriptId": "my-workers-script"
    }
  }
}

​

Syncing while a version is pending

If someone uploads a version of the Worker without deploying it, for example with wrangler versions upload, that version is pending, and Cloudflare doesn’t let Infisical change the Worker’s secrets directly. Instead, Cloudflare creates a new version from the pending one with the updated secrets, and Infisical labels it with the infisical-sync tag.

Infisical doesn’t deploy the new version, because deploying it also deploys the pending changes. The sync’s status shows the ID of the new version, and the secrets take effect when you deploy that version in Cloudflare.

​

Removing secrets while a version is pending

Infisical can only remove secrets while the Worker’s latest version is the deployed one, so if a version is pending, removing secrets fails and nothing on the Worker changes. If you delete the sync with Remove Synced Secrets turned on, Infisical keeps the sync. To remove the secrets, deploy the pending version in Cloudflare, then remove the secrets again.