Secrets & Env

A deployed project reads its configuration through env bindings in the Worker — the same place D1, KV, and R2 show up. There are two kinds of configuration: plain environment variables for non-sensitive values, and durable secrets for credentials. They behave differently, and choosing the right one matters.

Environment variables vs secrets

Set both from the project’s Environment and Secrets tabs in the hosting console, or through the deploy.* MCP tools (an agent runs them for you). Neither goes through the CLI, which keeps secret values out of shell history.

Environment variables

Use deploy.env_set for plain, non-sensitive configuration:

deploy.env_set {projectId, vars: { API_BASE: "https://api.example.com" }}

Like data bindings, env vars take effect on the next ship — set them, then re-ship:

yolo deploy   # re-ship so the new var is bound into the Worker

Read it in the Worker:

const base = env.API_BASE;

These values are stored and auditable, so keep credentials out of them. Anything sensitive belongs in a secret.

Secrets

Use deploy.set_secret for real credentials:

deploy.set_secret {projectId, name: "STRIPE_SECRET_KEY", value: "sk_live_..."}

Read it in the Worker exactly like an env var:

const stripe = new Stripe(env.STRIPE_SECRET_KEY);

Secrets behave differently from env vars in two important ways:

• Live immediately. A secret applies to the current live release right away — no re-ship needed for it to take effect.
• Durable across ships and rollbacks. The encrypted value is re-applied to every future release automatically, so it survives every deploy and rollback. You set it once.

The value goes straight to an encrypted vault and to Cloudflare — it is never written to our application database or logged. We only ever store the secret’s name.

Secret names are uppercase letters, numbers, and underscores, starting with a letter (for example STRIPE_SECRET_KEY).

When production approvals are enabled, setting a secret routes to you for operator approval in the webapp, the same as a production ship. Approvals are not currently enabled on YOLO Host — see Production approvals.

Quick reference

deploy.env_set    {projectId, vars}          # non-secret config → binds on next ship
deploy.set_secret {projectId, name, value}   # credential → live now + every future ship

• Public config, flags, base URLs → env_set, then re-ship.
• API keys, tokens, passwords → set_secret, live immediately, never re-set.

Related pages

• Managed Hosting — the deploy flow and CLI commands
• Managed Data — databases, KV, object storage, and FlexDB