Environment variables & secrets

Configuration and secrets, API keys, feature flags, third-party credentials, are set on the app, encrypted where needed, and injected into env at deploy. Your route code just reads them off the env object.

Setting values

Manage values with the MCP tools (your assistant calls these for you):

  • manage_app_env (action: set), set a variable. Pass secret: true for sensitive values: they're strongly encrypted at rest and never shown again.
  • manage_app_env (action: list), list configured values. Secret values are masked.
  • manage_app_env (action: delete), remove a value.
Use secret: true for anything sensitive (API keys, tokens, webhook signing secrets). Plain variables stay readable in the dashboard; secrets can be replaced but never read back.

Reading them in your code

Set values appear directly on env in your route handlers:

// api/search.js
export default {
  async fetch(request, env, ctx) {
    const res = await fetch("https://api.example.com/search", {
      headers: { Authorization: "Bearer " + env.SEARCH_API_KEY },
    });
    return new Response(await res.text());
  },
};

Built-in variables

Two are always present, no setup required:

  • env.APP_ID, your app's unique slug.
  • env.ENVIRONMENT, "production" on a production deploy of main, otherwise "preview" (every branch and preview deploy). Branch on this to change behavior between preview and production. (Inside a unit-test run it's "unit-test".)

Convention-named keys

Some platform features look for specific variable names. Set these with manage_app_env (action: set, as secrets) to enable them:

  • OPENAI_API_KEY / ANTHROPIC_API_KEY / GOOGLE_API_KEY / TYPESAFE_API_KEY, bring your own account for those providers (env.AI.cloudrizz is included with no vendor key, metered against your AI credits, see AI).
  • STRIPE_SECRET_KEY / STRIPE_WEBHOOK_SECRET, enable payments.
  • CR_AUTH_MS_*, CR_AUTH_GOOGLE_* andCR_AUTH_APPLE_* (TEAM_ID, KEY_ID,PRIVATE_KEY, BUNDLE_ID, SERVICES_ID), sign in with Microsoft, Google and Apple; seeAuth.
  • CR_AUTH_STEAM_APP_ID, CR_AUTH_STEAM_WEB_API_KEY,CR_AUTH_STEAM_IDENTITY, CR_AUTH_DISCORD_CLIENT_ID,CR_AUTH_DISCORD_CLIENT_SECRET, players on Steam and Discord;CR_AUTH_GAME_RATE_PER_IP / CR_AUTH_GAME_RATE_PER_APPraise their sign-in limits; seeGames.
  • CR_PUSH_FCM_SERVICE_ACCOUNT, push notifications withenv.PUSH; seeMobile apps.
  • *_TEST variants (e.g. STRIPE_SECRET_KEY_TEST) are used automatically on non-production deploys when present, so previews can hit test credentials.

When values apply

Variables are injected at deploy. After changing one, redeploy (deploy_app) for it to take effect. Secrets are encrypted in storage and only decrypted into your app's running env.