Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

`cf workers secrets update` replaces the entire secret set instead of patching a single secret

Open
  • Is something wrong?
#96 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
api, cli, cloud

Research direction

Start at the cf workers secrets update command entry point and compare its dry-run request with cf workers secrets bulk, including the /secrets and /secrets-bulk endpoints. Reproduce the two-secret sequence from the issue and inspect the existing command tests or request handling. Done means updating one secret leaves other secrets unchanged, with coverage for the reported sequence or clearly documented replacement behavior.

Written by the indexing model from the issue text.

Description

cf version: 1.0.0-beta.5, macOS

What happens

cf workers secrets update <NAME> --worker <worker> --type secret_text --text <value> sets the named secret, but silently deletes every other secret already on the Worker — it's not a patch, it's a full replace.

Hit this for real while migrating a production Worker (8 secrets already set via wrangler secret put, working fine). Ran cf workers secrets update RUN_TOKEN --worker web-qa-jev-agent --type secret_text --text "<new-token>" to rotate one token. cf workers secrets list --worker web-qa-jev-agent immediately after came back [{"name": "RUN_TOKEN", ...}] — the other 7 (GitHub App auth, webhook secret, target URL) were gone. Broke GitHub App auth and a webhook trigger until manually restored via wrangler secret put.

Repro

cf init repro-cf --package-manager npm
cd repro-cf
cf deploy   # after declaring at least one bindings.secret() per #70/#72's workaround, or use --secrets-file
cf workers secrets update FIRST --worker repro-cf --type secret_text --text a
cf workers secrets list --worker repro-cf     # [FIRST]
cf workers secrets update SECOND --worker repro-cf --type secret_text --text b
cf workers secrets list --worker repro-cf     # [SECOND] -- FIRST is gone

What I found

cf workers secrets update --dry-run shows exactly why:

{
  "command": "cf workers secrets update",
  "method": "PUT",
  "url": "https://api.cloudflare.com/client/v4/accounts/{account}/workers/scripts/{script}/secrets",
  "body": { "name": "SECOND", "type": "secret_text", "text": "b" }
}

It's a PUT to the plain /secrets collection endpoint with only the one secret in the body — a full replace, not a merge. Compare to cf workers secrets bulk --dry-run with the same secret:

{
  "command": "cf workers secrets bulk",
  "method": "PATCH",
  "url": "https://api.cloudflare.com/client/v4/accounts/{account}/workers/scripts/{script}/secrets-bulk",
  "body": { "SECOND": { "type": "secret_text", "text": "b" } }
}

bulk hits a different endpoint (/secrets-bulk) with PATCH/RFC 7396 merge semantics — its own --help text even says "Secrets not included in the request are left unchanged" and recommends it over update for multi-secret changes. But nothing in update's own --help or command name suggests that a single-secret call is just as destructive to every other existing secret. This looks like the same root-cause family as #70/#72/#54 (PUT-only API, no merge-on-single-field-update), specifically for the one command whose entire job description ("Add a secret to a Worker script") implies it should be additive.

Expected

cf workers secrets update either performs a genuine patch (e.g. by using the bulk/secrets-bulk endpoint under the hood when only one secret is given), or its --help/docs state unambiguously that it replaces the whole secret set — right now the command name and description ("Add a secret...") actively suggest the opposite of what it does.

Workaround

Use cf workers secrets bulk --body '{"NAME": {"type": "secret_text", "text": "value"}}' instead of update, always, even for a single secret on a Worker that has others set.

Dominant language
TypeScript
Stars
853
Forks
42
Avg merge
17h 57m
Merged PRs (30d)
146

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudflare/cf

All issues in cloudflare/cf

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.