Cloudflare Workers is useful when you want globally distributed execution, rapid scaling, and no
container fleet to patch. It is a supported source deployment and does not use the
composiohq/keyring:alpha container image.
Workers do not provide the same KMS workload identity as ECS or Cloud Run. Review how Keyring will
authenticate to your KMS and avoid long-lived cloud credentials where possible.
ENCRYPTION_CONFIG must be inline JSON; Worker isolates cannot mount a configuration file.- File-based GCP credentials and Vault Kubernetes tokens are unsupported.
- AWS access can use encrypted Worker secrets, but ECS container credentials are unavailable.
- Your KMS, Vault, Composio JWKS, provider, and collector endpoints must be reachable from Workers.
- In-process key caches are isolate-local; eviction causes another safe KMS unwrap, not credential loss.
Workers cannot run a collector sidecar. Choose a remote collector or compatible public endpoint using
the telemetry delivery guide.
Use Node 24 and define staging and production separately in wrangler.jsonc:
Wrangler environment variables do not inherit from the top-level configuration. Include every required
value in each deployed environment.
2. Add secrets
Create a complete inline JSON value from the
KMS adapter configuration, then store it as a Worker secret:
If an AWS adapter uses environment credentials, also add AWS_ACCESS_KEY_ID,
AWS_SECRET_ACCESS_KEY, and an optional AWS_SESSION_TOKEN as Worker secrets. Never place credentials
or ENCRYPTION_CONFIG in plain Wrangler variables or source control.
Repeat the secret setup for staging; Worker secrets are environment-specific.
3. Validate and deploy
4. Verify and connect
Protect the production Worker with a source allowlist or equivalent Cloudflare edge control, then
connect it to Composio.
See Cloudflare’s secrets documentation
and Wrangler environment behavior
for current platform details. 
