Secret executor

The @naxodev/nx-cloudflare:secret executor runs wrangler secret <command> for a Worker. Secret values are never passed as command arguments. The plugin infers a secret target for every Worker, exposing four Nx configurations — put, bulk, list, and delete — that set command for you. See Manage Worker secrets for a task-oriented walkthrough.

Options

Option	Type	Default	Description
command	put | bulk | list | delete	(required)	The secret subcommand. Supplied by the target's configuration.
name	string	-	The secret KEY. Required for put/delete.
file	string	-	Path to a JSON file of secrets. Required for bulk.
env	string	-	Cloudflare environment (--env).
versioned	boolean	false	Run wrangler versions secret <command> (stages the change on a new version for gradual deployment) instead of wrangler secret <command>. Set by the version-secret target's configuration.

command is set by the inferred target’s configuration. versioned is set by the version-secret target’s configuration (see below) — you don’t pass either yourself.

Configurations

put

Runs wrangler secret put <name>. Prompts interactively for the value; requires --name.

bunx nx run my-worker:secret:put --name=API_KEY

bulk

Runs wrangler secret bulk <file>. Uploads multiple secrets from a JSON file; requires --file. Do not commit that file.

bunx nx run my-worker:secret:bulk --file=secrets.json

list

Runs wrangler secret list. Lists the names of all secrets bound to the Worker — values are never exposed.

bunx nx run my-worker:secret:list

delete

Runs wrangler secret delete <name>. Requires --name.

bunx nx run my-worker:secret:delete --name=API_KEY

The versioned variant

The plugin also infers a version-secret target alongside secret, running the same executor with versioned: true baked in by its configuration. Where secret acts on the currently deployed Worker, version-secret stages the same put/bulk/list/delete operations on a new version (wrangler versions secret <command>) without shifting traffic — pair it with version-deploy for gradual deployments.

bunx nx run my-worker:version-secret:put --name=API_KEY
bunx nx run my-worker:version-deploy

Notes

• Every configuration accepts --env <environment> for a Wrangler environment.
• Secrets are not declared in wrangler.jsonc, so the secret and version-secret targets are inferred for every Worker regardless of config format (jsonc/json/toml).
• Arbitrary -- <wrangler flag> passthrough does not apply to this executor — only the typed options above are accepted.

Next steps

• Manage Worker secrets — step-by-step guide
• Inferred targets — the full target reference
• application generator — scaffold a Worker