Skip to main content
Cloudflare Workers is useful when you want globally distributed execution, rapid scaling, and no container fleet to patch. It is a supported source deployment and does not use the composiohq/keyring:alpha container image.
Workers do not provide the same KMS workload identity as ECS or Cloud Run. Review how Keyring will authenticate to your KMS and avoid long-lived cloud credentials where possible.

​
Platform considerations

  • ENCRYPTION_CONFIG must be inline JSON; Worker isolates cannot mount a configuration file.
  • File-based GCP credentials and Vault Kubernetes tokens are unsupported.
  • AWS access can use encrypted Worker secrets, but ECS container credentials are unavailable.
  • Your KMS, Vault, Composio JWKS, provider, and collector endpoints must be reachable from Workers.
  • In-process key caches are isolate-local; eviction causes another safe KMS unwrap, not credential loss.
Workers cannot run a collector sidecar. Choose a remote collector or compatible public endpoint using the telemetry delivery guide.

​
1. Configure environments

Use Node 24 and define staging and production separately in wrangler.jsonc:
Wrangler environment variables do not inherit from the top-level configuration. Include every required value in each deployed environment.

​
2. Add secrets

Create a complete inline JSON value from the KMS adapter configuration, then store it as a Worker secret:
If an AWS adapter uses environment credentials, also add AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and an optional AWS_SESSION_TOKEN as Worker secrets. Never place credentials or ENCRYPTION_CONFIG in plain Wrangler variables or source control. Repeat the secret setup for staging; Worker secrets are environment-specific.

​
3. Validate and deploy

​
4. Verify and connect

Protect the production Worker with a source allowlist or equivalent Cloudflare edge control, then connect it to Composio. See Cloudflare’s secrets documentation and Wrangler environment behavior for current platform details.