Secrets

The provider credential, and where it lives.

On Cloudflare the provider API key is stored as a Worker secret rather than a var, so it is not written into wrangler.toml.

wrangler secret put OPENAI_API_KEY

meted deploy does this for you, piping the value from your environment on stdin so it is never printed to the terminal or written to a file.

What the config stores

{
  "provider": {
    "apiKeyEnv": "OPENAI_API_KEY",
  },
}

The name of the environment variable, not its value, which is what makes meted.config.json safe to commit.

Reading it

Locally, from your shell:

export OPENAI_API_KEY=sk-…
meted dev

On Cloudflare, from the Worker's environment, which is where wrangler secret put places it. Same code path, same variable name.

Rotating

wrangler secret put OPENAI_API_KEY

No redeploy needed. The Worker caches its gateway per isolate and rebuilds it when the credential changes, so the new key is picked up as isolates recycle.

What Meted does with it

Sets one header on the upstream request:

authorization: Bearer <key>

Any inbound Authorization header from your client is stripped first, so a client cannot use the gateway to relay an arbitrary key.

Where the credential is not written

The key is read from process.env[apiKeyEnv], or from the Worker environment, at request time. It is held in memory for the lifetime of the gateway and used for one purpose: the authorization header on the upstream request.

It is not written to meted.config.json, to the meted dev log, to any x-meted-* response header, or to any file Meted creates. meted deploy pipes it to wrangler secret put on stdin rather than passing it as an argument, so it does not reach the shell history or the process list.

Other headers

Some providers need more than a bearer token:

{
  "provider": {
    "baseUrl": "https://my-resource.openai.azure.com/openai/v1",
    "apiKeyEnv": "AZURE_OPENAI_KEY",
    "headers": {
      "openai-project": "proj_abc123",
    },
  },
}

headers lives in the committed config, so it is for non-secret values. Put anything sensitive in an environment variable or a Cloudflare secret.

Missing credential

{
  "error": {
    "message": "No provider credential. Set OPENAI_API_KEY in the environment where Meted runs.",
    "type": "authentication_error"
  }
}

401, naming the variable. meted dev also warns at start-up.