jack secrets

Manage project secrets securely. Secrets are stored in Cloudflare and never written to disk.

Usage

jack secrets <command> [options]

Commands

Options

Examples

Set a secret interactively (recommended)

jack secrets set DATABASE_URL
# Enter value for DATABASE_URL: ********
# ✓ Secret set: DATABASE_URL

Set a secret inline

jack secrets set API_KEY=sk-1234567890
# ⚠ Value visible in shell history. Use interactive mode for sensitive secrets.
# ✓ Secret set: API_KEY

Pipe from environment (CI/CD)

echo $PRODUCTION_KEY | jack secrets set STRIPE_KEY

List secrets

jack secrets list
#   DATABASE_URL
#   API_KEY
#   STRIPE_KEY

Remove a secret

jack secrets rm API_KEY
# ✓ Secret removed: API_KEY

Specify project explicitly

jack secrets list --project my-api

How It Works

• Managed projects: Secrets are stored via the jack control plane
• BYO projects: Secrets are stored via wrangler secret commands

Secrets are injected at runtime and available in your worker via the environment:

export default {
  async fetch(request: Request, env: Env) {
    // Access your secrets
    const dbUrl = env.DATABASE_URL;
    const apiKey = env.API_KEY;
    // ...
  }
}

Notes

• Secret names must start with a letter or underscore
• Only letters, numbers, and underscores are allowed
• VITE_* secrets are embedded at build time, not runtime—add them to .env instead
• Secrets are never logged or written to disk locally