Connect GitHub Actions Env Vars and Secrets with Cloudflare

To connect GitHub Actions environment variables and secrets with Cloudflare (Workers, Pages, or Cloudflare API deployments), you configure secrets in your GitHub repository and pass them into the wrangler-action or custom CI/CD workflow steps.

Architecture Flow#

flowchart LR
    subgraph GitHub["GitHub Ecosystem"]
        G_SEC["GitHub Secrets & Vars<br>(CLOUDFLARE_API_TOKEN, DB_PASS, APP_ENV)"]
        G_ACT["GitHub Actions Runner<br>(CI/CD Pipeline)"]
        G_SEC -->|Inject via env / with| G_ACT
    end

    subgraph CF["Cloudflare Platform"]
        WRANGLER["Cloudflare Wrangler / Deploy Action"]
        CF_WORKER["Cloudflare Worker / Pages / Resource"]
        G_ACT -->|Authenticate & Deploy| WRANGLER
        WRANGLER -->|Push Code, Vars & Secrets| CF_WORKER
    end

Step 1: Obtain Cloudflare Credentials#

Here is how to locate and generate both credentials from your Cloudflare dashboard:

1. Get CLOUDFLARE_ACCOUNT_ID#

Your Account ID is a 32-character hexadecimal string tied to your Cloudflare account.

Method A: From Workers & Pages (Fastest)
1. Log in to the Cloudflare Dashboard ↗.
2. In the left sidebar, click Compute (Workers & Pages) (or Workers & Pages).
3. Look at the right-hand sidebar under Account details — click to copy your Account ID.
Method B: From the URL
1. When logged into the dashboard, select any domain or section.
2. Look at your browser’s address bar: https://dash.cloudflare.com/<ACCOUNT_ID>/workers-and-pages
3. The string immediately following dash.cloudflare.com/ is your Account ID.

2. Generate CLOUDFLARE_API_TOKEN#

Do not use your Global API Key. Create a scoped API Token with minimal necessary permissions.

In the top-right corner of the dashboard, click your User Profile icon -> My Profile.
Select API Tokens from the left navigation.
Click Create Token.
Use a pre-made template or custom setup:
- Using a Template: Find Edit Cloudflare Workers and click Use template.
- Custom Token: Select Create Custom Token and configure:
  - Permissions:
    - Account -> Workers Scripts -> Edit
    - Account -> Workers KV Storage -> Edit (if using KV)
    - Account -> Pages -> Edit (if deploying Pages)
  - Account Resources: Include -> All accounts (or select your specific account).
Scroll to the bottom and click Continue to summary -> Create Token.
Copy the token immediately. Cloudflare only displays it once.

Quick Verification via CLI#

You can verify that your credentials work correctly by testing them with curl in your terminal:

curl -X GET "https://api.cloudflare.com/client/v4/user/tokens/verify" \
  -H "Authorization: Bearer <YOUR_CLOUDFLARE_API_TOKEN>"

bash

A response of "status": "active" confirms the token is valid and ready to be added to your GitHub Secrets.

Step 2: Configure Secrets in GitHub#

Go to Repository Settings > Secrets and variables > Actions and define:

1. Repository Secrets (Encrypted / Sensitive)#

CLOUDFLARE_API_TOKEN: Cloudflare API token with Worker:Edit or Pages:Edit permissions.
CLOUDFLARE_ACCOUNT_ID: Your Cloudflare Account ID.
APP_SECRET_KEY: Sensitive keys used inside the application runtime.

2. Repository Variables (Plain text / Non-sensitive)#

ENVIRONMENT: production or staging.
API_BASE_URL: https://api.example.com.

Step 3: GitHub Actions Workflow Configuration#

Create .github/workflows/deploy.yml to pass variables and secrets during deployment:

.github/workflows/deploy.yml

name: Deploy to Cloudflare

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    name: Deploy
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install dependencies
        run: npm ci

      - name: Deploy to Cloudflare Workers
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: deploy
        env:
          # Injected into the Wrangler build environment
          ENVIRONMENT: ${{ vars.ENVIRONMENT }}
          API_BASE_URL: ${{ vars.API_BASE_URL }}
          APP_SECRET_KEY: ${{ secrets.APP_SECRET_KEY }}

yaml

Step 4: Accessing Variables in Cloudflare#

Depending on whether you are using plaintext variables or encrypted runtime secrets, configure wrangler.jsonc / wrangler.toml or set them directly:

1. Plaintext Variables (`wrangler.jsonc`)#

Non-sensitive variables can be bound directly in the config file:

wrangler.jsonc

{
  "name": "my-worker",
  "main": "src/index.ts",
  "compatibility_date": "2026-08-01",
  "vars": {
    "ENVIRONMENT": "production",
    "API_BASE_URL": "https://api.example.com"
  }
}

json

2. Runtime Encrypted Secrets (Pushed via Wrangler)#

To upload secrets directly from GitHub Actions to Cloudflare without checking them into source code:

      - name: Push Secrets to Cloudflare Worker
        run: |
          echo "${{ secrets.APP_SECRET_KEY }}" | npx wrangler secret put APP_SECRET_KEY
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}