> ## Documentation Index
> Fetch the complete documentation index at: https://keyring.docs.composio.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy to Cloudflare Workers

> Run Keyring on a globally distributed serverless platform with Worker secrets and managed scaling.

Cloudflare Workers is useful when you want globally distributed execution, rapid scaling, and no
container fleet to patch. It is a supported source deployment and does not use the
`composiohq/keyring:alpha` container image.

<Warning>
  Workers do not provide the same KMS workload identity as ECS or Cloud Run. Review how Keyring will
  authenticate to your KMS and avoid long-lived cloud credentials where possible.
</Warning>

## Platform considerations

* `ENCRYPTION_CONFIG` must be inline JSON; Worker isolates cannot mount a configuration file.
* File-based GCP credentials and Vault Kubernetes tokens are unsupported.
* AWS access can use encrypted Worker secrets, but ECS container credentials are unavailable.
* Your KMS, Vault, Composio JWKS, provider, and collector endpoints must be reachable from Workers.
* In-process key caches are isolate-local; eviction causes another safe KMS unwrap, not credential loss.

Workers cannot run a collector sidecar. Choose a remote collector or compatible public endpoint using
the [telemetry delivery guide](/deployment/observability#direct-vendor-endpoint).

## 1. Configure environments

Use Node 24 and define staging and production separately in `wrangler.jsonc`:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
nvm use 24
```

```jsonc theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "APP_ENV": "production",
  "AUDIT_DURABILITY": "required",
  "AUTH_AUDIENCE": "<COMPOSIO_ORG_ID>",
  "AUTH_ISSUER": "https://backend.composio.dev",
  "AUTH_JWT_ALGORITHMS": "RS256",
  "AUTH_JWKS_URL": "https://backend.composio.dev/.well-known/jwks.json",
  "LOG_LEVEL": "info",
  "OTEL_COLLECTOR_URL": "https://otel.example.com",
  "RUNTIME": "cloudflare_worker",
}
```

Wrangler environment variables do not inherit from the top-level configuration. Include every required
value in each deployed environment.

## 2. Add secrets

Create a complete inline JSON value from the
[KMS adapter configuration](/configuration/kms_adapters), then store it as a Worker secret:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
pnpm wrangler secret put ENCRYPTION_CONFIG --env production
pnpm wrangler secret put OTEL_COLLECTOR_HEADERS --env production
```

If an AWS adapter uses environment credentials, also add `AWS_ACCESS_KEY_ID`,
`AWS_SECRET_ACCESS_KEY`, and an optional `AWS_SESSION_TOKEN` as Worker secrets. Never place credentials
or `ENCRYPTION_CONFIG` in plain Wrangler variables or source control.

Repeat the secret setup for staging; Worker secrets are environment-specific.

## 3. Validate and deploy

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
nvm use 24
pnpm run cf-typegen
pnpm run build:staging
pnpm run build:production
pnpm run deploy:staging
pnpm run deploy:production
```

## 4. Verify and connect

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl --fail https://keyring.example.workers.dev/healthz
curl --fail https://keyring.example.workers.dev/transfer-keys
```

Protect the production Worker with a source allowlist or equivalent Cloudflare edge control, then
[connect it to Composio](/deployment/overview#connect-keyring-to-composio).

See Cloudflare's [secrets documentation](https://developers.cloudflare.com/workers/configuration/secrets/)
and [Wrangler environment behavior](https://developers.cloudflare.com/workers/wrangler/environments/)
for current platform details.