Cloudflare Workers

Start with a Hono Cloudflare Workers app, with Wrangler installed. Follow Install, Encrypt, and Commit.

Workers receive secrets through bindings. Replace the Node entry point with:

// src/index.ts
import { Hono } from 'hono'

type Bindings = {
  HELLO: string
}

const app = new Hono<{ Bindings: Bindings }>()

app.get('/', (c) => c.text(`Hello ${c.env.HELLO}`))

export default app

In your existing wrangler.jsonc, keep main pointing to src/index.ts and add:

{
  "secrets": {
    "required": ["HELLO"]
  }
}

Use .env for this setup and do not create .dev.vars; Wrangler gives .dev.vars precedence over its .env and process-environment loader.

Update your dev script:

{
  "scripts": {
    "dev": "dotenvx run --strict -- wrangler dev"
  }
}

$ npm run dev

$ pnpm dev

Dotenvx decrypts .env before Wrangler starts. Wrangler loads HELLO from the process environment and exposes it as c.env.HELLO. Visit http://localhost:8787 to see Hello Secret.

Use Share for team access. For deployment, follow the Cloudflare Production flow, including its production key setup and deploy script. That script decrypts .env.production on the deployment machine and sends the values to Cloudflare as Worker secrets.

The Worker reads those bindings at runtime. It does not run the Node start script or need a Dotenvx private key in the Worker.