> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare Workers sync

> Learn how to configure a Cloudflare Workers Sync for Infisical.

**Prerequisites:**

* Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
* Create a [Cloudflare Connection](https://infisical.com/docs/integrations/app-connections/cloudflare.md)

> [tab] Infisical UI
>
> 1. Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Select the **Add Sync** button.
>
>    ![Secret Syncs Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/general/secret-sync-tab.png)
>
> 2. Select the **Cloudflare Workers** option.
>
>    ![Select Cloudflare Workers](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/cloudflare-workers/select-cloudflare-workers-option.png)
>
> 3. Configure the **Source** from where secrets should be retrieved, then click **Next**.
>
>    ![Configure Source](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/cloudflare-workers/cloudflare-workers-sync-source.png)
>
> * **Environment**: The project environment to retrieve secrets from.
>
> * **Secret Path**: The folder path to retrieve secrets from.
>
> > [!TIP]
> >
> > If you need to sync secrets from multiple folder locations, check out [secret imports](https://infisical.com/docs/documentation/platform/secret-reference.md#secret-imports).
>
> 4. Configure the **Destination** to where secrets should be deployed, then click **Next**.
>
>    ![Configure Destination](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/cloudflare-workers/cloudflare-workers-sync-destination.png)
>
> * **Cloudflare Connection**: The Cloudflare Connection to authenticate with.
>
> * **Cloudflare Workers Script**: Choose the Cloudflare Workers script you want to sync secrets to.
>
> 5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
>
>    ![Configure Options](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/cloudflare-workers/cloudflare-workers-sync-options.png)
>
> * **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
>   * **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
> * **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
> * **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
> * **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
> * **Variable type**: How Cloudflare stores each synced secret
>   * **Secret**: Encrypted, so you can't read the value in the Cloudflare dashboard
>   * **Text**: Plain text that you can read in the Cloudflare dashboard
>   * **JSON**: A JSON value that your Worker receives already parsed (each secret value must be valid JSON)
>
> If a secret already exists on the Worker as a different type, the sync fails with an error that names it, and nothing on the Worker changes. To sync it, delete the variable in Cloudflare or change the sync's variable type. With **Sync plaintext and JSON variables** turned on, a Secret sync updates existing text and JSON variables as they are instead. Syncs created before the variable type option existed skip those secrets rather than failing.
>
> 6. Configure the **Details** of your Cloudflare Workers Sync, then click **Next**.
>
>    ![Configure Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/cloudflare-workers/cloudflare-workers-sync-details.png)
>
> * **Name**: The name of your sync. Must be slug-friendly.
>
> * **Description**: An optional description for your sync.
>
> 7. Review your Cloudflare Workers Sync configuration, then click **Create Sync**.
>
>    ![Confirm Configuration](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/cloudflare-workers/cloudflare-workers-sync-review.png)
>
> 8. If enabled, your Cloudflare Workers Sync will begin syncing your secrets to the destination endpoint.
>
>    ![Sync Secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/cloudflare-workers/cloudflare-workers-sync-created.png)

> [tab] API
>
> To create a **Cloudflare Workers Sync**, make an API request to the [Create Cloudflare Workers Sync](https://infisical.com/docs/api-reference/endpoints/secret-syncs/cloudflare-workers/create.md) API endpoint.
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/secret-syncs/cloudflare-workers \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "name": "my-cloudflare-workers-sync",
>     "projectId": "your-project-id",
>     "description": "an example sync",
>     "connectionId": "your-cloudflare-connection-id",
>     "environment": "production",
>     "secretPath": "/my-secrets",
>     "isEnabled": true,
>     "syncOptions": {
>       "initialSyncBehavior": "overwrite-destination"
>     },
>     "destinationConfig": {
>       "scriptId": "my-workers-script"
>     }
>   }'
> ```
>
> ### Sample response
>
> ```bash Response theme={"dark"}
> {
>   "secretSync": {
>     "id": "your-sync-id",
>     "name": "my-cloudflare-workers-sync",
>     "description": "an example sync",
>     "isEnabled": true,
>     "version": 1,
>     "folderId": "your-folder-id",
>     "connectionId": "your-cloudflare-connection-id",
>     "createdAt": "2024-05-01T12:00:00Z",
>     "updatedAt": "2024-05-01T12:00:00Z",
>     "syncStatus": "succeeded",
>     "lastSyncJobId": "123",
>     "lastSyncMessage": null,
>     "lastSyncedAt": "2024-05-01T12:00:00Z",
>     "syncOptions": {
>       "initialSyncBehavior": "overwrite-destination"
>     },
>     "projectId": "your-project-id",
>     "connection": {
>       "app": "cloudflare",
>       "name": "my-cloudflare-connection",
>       "id": "your-cloudflare-connection-id"
>     },
>     "environment": {
>       "slug": "production",
>       "name": "Production",
>       "id": "your-env-id"
>     },
>     "folder": {
>       "id": "your-folder-id",
>       "path": "/my-secrets"
>     },
>     "destination": "cloudflare-workers",
>     "destinationConfig": {
>       "scriptId": "my-workers-script"
>     }
>   }
> }
> ```

## Syncing while a version is pending

If someone uploads a version of the Worker without deploying it, for example with `wrangler versions upload`, that version is pending, and Cloudflare doesn't let Infisical change the Worker's secrets directly. Instead, Cloudflare creates a new version from the pending one with the updated secrets, and Infisical labels it with the `infisical-sync` tag.

Infisical doesn't deploy the new version, because deploying it also deploys the pending changes. The sync's status shows the ID of the new version, and the secrets take effect when you [deploy that version](https://developers.cloudflare.com/workers/versions-and-deployments/) in Cloudflare.

### Removing secrets while a version is pending

Infisical can only remove secrets while the Worker's latest version is the deployed one, so if a version is pending, removing secrets fails and nothing on the Worker changes. If you delete the sync with **Remove Synced Secrets** turned on, Infisical keeps the sync. To remove the secrets, deploy the pending version in Cloudflare, then remove the secrets again.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.