Environment secrets on Cloudflare

Store Supabase keys, Stripe secrets, and feed defaults in Cloudflare dashboard vars, not in the git tree.

Close-up of white Cat-5e Ethernet cables with RJ45 connectors
Probe JSON usually leaves the LAN over Ethernet or a nearby relay, not the public internet directly. Photo: DiscDepotDundee.co.uk. CC BY-SA 4.0

Edge-deployed Astro reads configuration from Cloudflare Workers environment at runtime. Service role keys and Stripe webhook secrets must never appear in client bundles or public GitHub repos. Separating **public** anon keys from **server-only** secrets mirrors relay hygiene in relay env vars.

Cloudflare dashboard secrets flowing to Worker runtime without appearing in client JS
Server-only secrets inject at deploy time; public anon keys may ship to the browser bundle.

Variable classes

  • PUBLIC_ prefix: safe for client islands if truly public.
  • Server secrets. Supabase service role, Stripe secret, webhook signing.
  • Per-environment: preview vs production values in separate namespaces.

Local development

Use .dev.vars gitignored locally; never commit. Rotate after laptop loss. Pair with middleware auth so mis-set keys fail closed on dashboard routes.

Deployment pipeline

CI sets secrets via wrangler or dashboard UI: document names in README without values. Related: Workers deployment and Tailwind v4 setup build env for CSS only.