# Cloudflare

## Prerequisites

Create a [Cloudflare Worker](https://developers.cloudflare.com/workers/get-started/guide/). Choose the Hello World example and JavaScript to follow along.

## Install

In your Worker project, install Dotenvx and [Wrangler](https://developers.cloudflare.com/workers/wrangler/install-and-update/).

**npm**

```console
$ npm install --save-dev @dotenvx/dotenvx
$ npm install --save-dev wrangler@latest
```

**pnpm**

```console
$ pnpm add -D @dotenvx/dotenvx
$ pnpm add -D wrangler@latest
```

## Encrypt

Start with a secret value in the .env file at your project root, like:

```dotenv
# .env
HELLO="Secret"
```

Encrypt it with a single command.

**npm**

```console
$ npx dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉
```

**pnpm**

```console
$ pnpm exec dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉
```

The values become ciphertext and only your private key can unlock them.

```dotenv
# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="
```

## Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git. Keep .env.keys out of git. The -f flag adds the encrypted file even if your project ignores .env files.

```console
$ git add -f .env
$ git commit -m "encrypt .env"
```

## Ship

Read your secrets through env. Update src/index.js:

```javascript
// src/index.js
export default {
  async fetch(request, env) {
    return new Response(`Hello ${env.HELLO}`)
  }
}
```

Add HELLO to the required secrets in your existing Wrangler configuration:

**wrangler.jsonc**

```json
{
  "secrets": {
    "required": ["HELLO"]
  }
}
```

Wrangler loads these named secrets from the process environment during local development. Use .env for this setup and do not create a .dev.vars file; Wrangler gives .dev.vars precedence over the .env and process-environment loader.

Update the dev script in your existing package.json:

**package.json**

```json
{
  "scripts": {
    "dev": "dotenvx run -- wrangler dev"
  }
}
```

Run your Worker:

**npm**

```console
$ npm run dev
```

**pnpm**

```console
$ pnpm dev
```

Dotenvx decrypts .env into the process environment. Wrangler gives those values precedence over the encrypted file and makes HELLO available to your Worker as env.HELLO. See [Wrangler's local environment handling](https://developers.cloudflare.com/workers/local-development/environment-variables/).

Visit [http://localhost:8787](http://localhost:8787) to see Hello Secret.

Browser response at [http://localhost:8787](http://localhost:8787):

```text
Hello Secret
```

## Share

Have teammates? Share access with Dotenvx Armor ⛨

Log in to Dotenvx.

**npm**

```console
$ npx dotenvx login
◉ logged in (username)
```

**pnpm**

```console
$ pnpm exec dotenvx login
◉ logged in (username)
```

Create the Armored Key ⛨

**npm**

```console
$ npx dotenvx armor up
⛨ armored .env (022 0D8)
```

**pnpm**

```console
$ pnpm exec dotenvx armor up
⛨ armored .env (022 0D8)
```

Invite your teammate.

**npm**

```console
$ npx dotenvx armor invite
⛨ invited person@example.com to team
```

**pnpm**

```console
$ pnpm exec dotenvx armor invite
⛨ invited person@example.com to team
```

Your teammate accepts the invitation, pulls the repository, installs dependencies, and logs in with dotenvx login. With the Wrangler configuration and dev script from [Ship](#ship), they can then run the Worker:

**npm**

```console
$ npm run dev
```

**pnpm**

```console
$ pnpm dev
```

Dotenvx decrypts .env through Armor and passes the values to Wrangler.

Visit [http://localhost:8787](http://localhost:8787) to see Hello Secret.

Browser response at [http://localhost:8787](http://localhost:8787):

```text
Hello Secret
```

[**Not using Armor?** Alternative →](https://dotenvx.com/docs/cloudflare/share-private-key.md)

## Production

Create a .env.production file.

```dotenv
# .env.production
HELLO="Production"
```

Encrypt it:

**npm**

```console
$ npx dotenvx encrypt -f .env.production
```

**pnpm**

```console
$ pnpm exec dotenvx encrypt -f .env.production
```

Store the production key in Armor so authorized teammates can deploy:

**npm**

```console
$ npx dotenvx armor up -f .env.production
```

**pnpm**

```console
$ pnpm exec dotenvx armor up -f .env.production
```

Commit .env.production. Keep .env.keys out of git.

```console
$ git add -f .env.production
$ git commit -m "encrypt .env.production"
```

Log in to Cloudflare:

**npm**

```console
$ npx wrangler login
```

**pnpm**

```console
$ pnpm exec wrangler login
```

Add the deploy script to your existing package.json, keeping the dev script from Ship:

**package.json**

```json
{
  "scripts": {
    "dev": "dotenvx run -- wrangler dev",
    "deploy": "bash -c 'dotenvx_secrets=\"$(dotenvx get -f .env.production --strict)\" && wrangler deploy --secrets-file <(printf \"%s\" \"$dotenvx_secrets\")'"
  }
}
```

The deploy script requires Bash. Deploy your Worker:

**npm**

```console
$ npm run deploy
```

**pnpm**

```console
$ pnpm deploy
```

Dotenvx decrypts .env.production through Armor. The && runs Wrangler only if decryption succeeds, and process substitution passes the JSON without saving a plaintext secrets file.

Wrangler [uploads the secrets alongside your code](https://developers.cloudflare.com/workers/configuration/secrets/#upload-secrets-alongside-code). Cloudflare stores the values as Worker secrets, and your Worker reads env.HELLO. The Dotenvx private key stays with Armor; the Worker does not need it.

Open the workers.dev URL printed by Wrangler to see Hello Production.

Browser response at [https://your-worker.your-subdomain.workers.dev](https://your-worker.your-subdomain.workers.dev):

```text
Hello Production
```

[**Using Cloudflare Pages?** Alternative →](https://dotenvx.com/docs/cloudflare/pages.md)

[**Want to decrypt inside your Worker?** Advanced →](https://dotenvx.com/docs/cloudflare/runtime-decryption.md)

## Conclusion

You've encrypted your secrets, shared access with Armor, and deployed your Worker with Wrangler. Your encrypted .env files travel with your code, and Cloudflare serves your production secrets through env.