# Zync.is Cloudflare Worker Secrets

All secrets are set via `wrangler secret put <NAME>` or the Cloudflare dashboard.
**Never commit real secrets.** Use `.dev.vars` locally (gitignored).

## Core Worker Secrets

| Secret | Description |
|--------|-------------|
| `JWT_SECRET` | HS256 signing key for session JWTs |
| `DATABASE_URL` | Direct Neon Postgres URL (used by drizzle-kit migrations; NOT used at runtime — runtime uses `DB` Hyperdrive binding) |
| `CRON_SECRET` | Bearer token for `/api/cron/*` endpoints (prevents unauthorized cron invocations) |
| `ADMIN_ENCRYPTION_KEY` | AES-256-GCM key for encrypting admin-level sensitive data at rest |
| `INTEGRATION_ENCRYPTION_KEY` | AES-256-GCM key for per-tenant integration credentials stored in DB — **never stored in Worker env per-tenant** |

## External Service Keys

| Secret | Description |
|--------|-------------|
| `RESEND_API_KEY` | Transactional email via Resend |
| `ANTHROPIC_API_KEY` | Claude API for AI features (expense OCR, categorization, etc.) |
| `UNSUBSCRIBE_HMAC_KEY` | HMAC key for one-click unsubscribe link signing |

## OAuth — Google

| Secret | Description |
|--------|-------------|
| `GOOGLE_OAUTH_CLIENT_ID` | Google OAuth 2.0 client ID |
| `GOOGLE_OAUTH_CLIENT_SECRET` | Google OAuth 2.0 client secret |

## OAuth — Microsoft

| Secret | Description |
|--------|-------------|
| `MICROSOFT_OAUTH_CLIENT_ID` | Microsoft Entra (Azure AD) client ID |
| `MICROSOFT_OAUTH_CLIENT_SECRET` | Microsoft Entra client secret |

## Cloudflare API Tokens

| Secret | Description |
|--------|-------------|
| `CF_CUSTOM_HOSTNAME_API_TOKEN` | Cloudflare API token for custom hostname provisioning (white-label) |
| `CF_ANALYTICS_READ_TOKEN` | Cloudflare Analytics API read token |

## Data

| Secret | Description |
|--------|-------------|
| `DATA_EXPORT_KEY` | Encryption key for tenant data export archives |

## Notes

- **Per-tenant integration secrets** (OAuth tokens, webhook signing keys, etc.) are encrypted with
  `INTEGRATION_ENCRYPTION_KEY` and stored in the database — never as Worker environment variables.
- **CF Email Routing** is configured via the Cloudflare dashboard only; there is no `email:*`
  wrangler OAuth scope for programmatic management.
- Set production secrets: `wrangler secret put <NAME> --env production`
- Set preview secrets: `wrangler secret put <NAME> --env preview`