Skip to content
digizeDocs

Variables and secrets

A site’s Worker reads its configuration from env. Both kinds of value are set on the Worker’s Bindings tab, not in wrangler.jsonc, so they can change without a push: vars in the config are not deployed.

src/index.ts
interface Env {
  STORE_NAME: string; // a variable
  PAYMENTS_TOKEN: string; // a secret
}


export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const upstream = await fetch("https://api.example.com/rates", {
      headers: { authorization: `Bearer ${env.PAYMENTS_TOKEN}` },
    });
    return new Response(`${env.STORE_NAME}: ${await upstream.text()}`);
  },
};

Variables

Section titled “Variables”

Environment variables are plain text: anyone who can see the Worker in the dashboard, or read it with a sites:read key, sees their values.

  • Names are letters, digits and underscores, not starting with a digit, up to 64 characters. A Worker has at most 64 variables, each up to 5,000 characters.
  • They reach the Worker from its next deploy. To apply a change without a push, Redeploy the live version.
  • Those whose names start with PUBLIC_, VITE_, NEXT_PUBLIC_, ASTRO_ or NUXT_PUBLIC_ are also given to the build, so a framework can inline them into the browser’s code (The build’s environment).

From the API, PATCH /api/v1/sites/{site} takes vars as an object of names and values, which replaces the whole set.

Secrets

Section titled “Secrets”

Secrets are sealed when they’re saved and never shown again: the dashboard and the API list only their names.

  • The same name rules as variables, and a value of 1 to 5,000 characters. A secret can’t have the name of a variable.
  • They reach the Worker as secret bindings at each deploy, opened only for the upload: the install and build never see them, and they’re never in a build’s log or archive.
  • Setting or deleting one on a live Worker also changes the running script straight away. If that can’t be done, it takes effect at the next deploy.

From the API, PUT /api/v1/sites/{site}/secrets/{secret} with { "value": "…" } adds or replaces a secret, and DELETE /api/v1/sites/{site}/secrets/{secret} removes it. Both answer { "applied": true } when the live Worker already has the change.

Terminal window
curl -X PUT https://digize.com/api/v1/sites/shop/secrets/PAYMENTS_TOKEN \
  -H "x-api-key: $DIGIZE_API_KEY" \
  -H "content-type: application/json" \
  -d '{"value":"sk_live_..."}'

Other values on env

Section titled “Other values on env”
  • Bindings to KV, D1, R2, queues and Durable Objects, from the config or the Bindings tab.
  • ASSETS (or the assets.binding you named), when the site has static assets and a Worker of its own.

Every name on env has to be unique: a variable, secret or binding that shares a name with another fails the deploy.