Environment Variables and Secrets
Vars live under [vars] in the root wrangler.toml and are readable in plain text. Secrets are set with wrangler secret put NAME and are never stored in files. For local development, .dev.vars (gitignored) overrides both. Changing a var means editing wrangler.toml and redeploying the API. A secret change applies without a redeploy.
API Worker
Section titled “API Worker”| Name | Kind | Required | Set by setup | Purpose |
|---|---|---|---|---|
BETTER_AUTH_SECRET |
Secret, private | Yes | Yes (generated) | Signs sessions and verification tokens. The API refuses session requests if it is missing or is Better Auth’s known default. Rotating it signs everyone out |
BETTER_AUTH_URL |
Var | Yes | Yes (first deploy) | The API’s own public URL. Change only with pnpm run update -- --auth |
CORS_ORIGINS |
Var | Yes | Adds the admin origin | Comma-separated allow-list of browser origins for credentialed requests, never *. Add your website’s origin yourself |
API_VERSION |
Var | Yes | Committed (v1) |
Reported by the health route |
ADMIN_URL |
Secret (set by setup) or var | Recommended | Yes | Admin origin used in verification and reset links. Falls back to the first CORS_ORIGINS entry |
EMAIL_PROVIDER |
Var | No | Optional prompt | resend or cloudflare. Unset means messages are logged, not sent |
EMAIL_FROM |
Var | With a provider | Optional prompt | Sender address |
RESEND_API_KEY |
Secret | With resend |
Optional prompt | Resend API key |
TRUSTED_PROXY_SECRET |
Secret | No | No | Lets a same-origin proxy pass the real visitor IP for rate limiting. Must match the value on your website |
TURNSTILE_SECRET_KEY |
Secret | No | Optional prompt | Requires a Cloudflare Turnstile token on public sign-up (POST /api/v1/auth/sign-up/email) and on any public form that has the human check turned on. Set with pnpm run update -- --turnstile (or wrangler secret put TURNSTILE_SECRET_KEY). Unset (the default), sign-up and forms ignore Turnstile entirely |
TURNSTILE_SITE_KEY |
Var | No | Optional prompt | The widget’s public site key, returned to frontends by GET /api/v1/system/status (turnstileSiteKey) so they don’t need their own copy. Set by pnpm run update -- --turnstile; a change needs a redeploy, which that command does |
OWNER_RECOVERY_SECRET |
Secret | No | No | Enables the break-glass owner recovery endpoint. Absent by default. A standing master key while set |
PAYSTACK_SECRET_KEY |
Secret | Commerce payments only | No | Paystack (sk_test_… or sk_live_…) |
PIXABAY_API_KEY |
Secret | No | No | Enables the Pixabay tab in the media picker. Optional: an Admin can instead enter the key in Settings → API → Image sources (stored encrypted); this secret takes precedence when both exist |
API_DOCS_ENABLED |
Var | No | No | "false" disables /api/v1/openapi.json and /api/v1/docs |
Bindings, not variables: DB (D1), MEDIA_BUCKET (R2), the rate limiters (Rate limiting), and for the Cloudflare email provider an EMAIL [[send_email]] binding.
Website (Astro)
Section titled “Website (Astro)”| Name | Kind | Purpose |
|---|---|---|
PUBLIC_KENRESOFT_CMS_URL |
Public, build-time | The CMS API origin. On Cloudflare Git builds, set it as a build variable |
TRUSTED_PROXY_SECRET |
Secret, server-only | Same value as the API’s. Never a PUBLIC_ variable |
PUBLIC_TURNSTILE_SITE_KEY |
Public, build-time | The site (public) half of your Turnstile widget, from the Cloudflare dashboard. Needed on the frontend to show the widget. Optional when the site reads the key from the API (system.status().turnstileSiteKey, set via TURNSTILE_SITE_KEY); the --astro starter reads only this variable. Not secret, but still build-time: on Cloudflare Git builds, set it as a build variable, the same way as PUBLIC_KENRESOFT_CMS_URL |
Admin build
Section titled “Admin build”VITE_API_URL is baked into the Admin build at build time and cannot be changed at runtime. pnpm run setup and pnpm run update set it for you.
pnpm run update -- <category flag> --ci (for example --auth --ci; the categories are auth, email, storage, database and domain) reads BETTER_AUTH_URL_NEW, EMAIL_PROVIDER_NEW, EMAIL_FROM_NEW, RESEND_API_KEY_NEW, CUSTOM_DOMAIN_NEW, DISABLE_WORKERS_DEV and ADMIN_CUSTOM_DOMAIN_NEW. TURNSTILE_SECRET_KEY has no configure category; set it directly with wrangler secret put. The optional GitHub Actions deploy uses the secrets CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID, and the variables DEPLOY_ENABLED and VITE_API_URL. UPDATE_BRANCH sets the default pnpm run update branch.