Secrets Store

Status: Supported

Configuration

OpenOrange reads the standard Wrangler Secrets Store binding:

{
  "secrets_store_secrets": [
    {
      "binding": "API_TOKEN",
      "store_id": "<STORE_ID>",
      "secret_name": "<SECRET_NAME>"
    }
  ]
}

For local development, provide the value under the binding name in .dev.vars or the process environment:

API_TOKEN=local-development-value

Keep .dev.vars out of version control.

How it works

The Worker receives a SecretsStoreSecret object at env.API_TOKEN, not the raw string. Calling await env.API_TOKEN.get() resolves the local value. Missing values produce an error that identifies the binding without printing the secret.

The local source reads .dev.vars once, caches the parsed values, and falls back to the process environment for names absent from that file. .dev.vars takes precedence when both sources contain the binding. It supports plain, single- quoted, and double-quoted assignments, optional export, comments, and common double-quoted escapes.

The source is replaceable so later providers can resolve the same binding without changing Worker code or Wrangler configuration. Neither successful reads nor failures log a secret value.

An end-to-end orange dev test configures a non-production value through the process environment, calls get() inside the bundled Worker, and verifies both the HTTP result and that the runtime and CLI output do not contain the value.

Conformance

• Static conformance checks the binding factory result against Cloudflare’s exact SecretsStoreSecret interface.
• Behavioral tests exercise successful and missing get() calls over workerd service-entrypoint RPC, while unit tests verify local file precedence, environment fallback, parser behavior, and value-safe errors.
• The CLI conformance fixture also requires orange types to produce the same self-contained declaration as pinned Wrangler and proves every generated secret property on Env is exactly the runtime factory’s result type.
• The development server test covers the binding’s configuration-to-runtime path.

Deviations

• Orange reads local values from .dev.vars or the process environment by binding name. Wrangler manages a separate local Secrets Store state.
• A quoted value can span lines, as in dotenv. Use this for a PEM key.
• Missing local values use an Orange-specific error that names the binding.
• Orange does not read a remote Cloudflare Secrets Store, and it has no Secrets Store management commands.