fix(wrangler): raise secrets-store value cap to 64 KiB

shiminshen · shiminshen · commit fe1e3989d803 · 2026-05-26T22:28:23.000+08:00
The API limit was 1024 characters when this PR was opened, but the
secrets-store team has since raised it to 64 KiB (65,536 bytes).
Validate by UTF-8 byte length to match the API doc exactly --
character-length would under-count multi-byte unicode and let
oversize values slip through.
diff --git a/.changeset/fix-secrets-store-value-length-validation.md b/.changeset/fix-secrets-store-value-length-validation.md
@@ -2,4 +2,4 @@
 "wrangler": patch
 ---
 
-`wrangler secrets-store secret create` and `secret update` now reject secret values longer than 1024 characters with a clear error before calling the Cloudflare API. Previously the CLI accepted them, the secret appeared in `secret list`, and the failure surfaced later (and confusingly) at worker deploy time as a "secret doesn't exist" error against the binding. The 1024-character cap is enforced by the API and dashboard; the CLI now enforces it at the same boundary. Fixes [#14018](https://github.com/cloudflare/workers-sdk/issues/14018).
+`wrangler secrets-store secret create` and `secret update` now reject secret values larger than 64 KiB (65,536 bytes) with a clear error before calling the Cloudflare API. Previously the CLI accepted them, the secret appeared in `secret list`, and the failure surfaced later (and confusingly) at worker deploy time as a "secret doesn't exist" error against the binding. 64 KiB is the cap enforced by the API; the CLI now enforces it at the same boundary. Fixes [#14018](https://github.com/cloudflare/workers-sdk/issues/14018).
diff --git a/packages/wrangler/src/__tests__/secrets-store.test.ts b/packages/wrangler/src/__tests__/secrets-store.test.ts
@@ -326,10 +326,10 @@ describe("secrets-store secret commands", () => {
 			`);
 		});
 
-		it("errors in creating a secret when value is longer than 1024 characters", async ({
+		it("errors in creating a secret when value is larger than 64 KiB", async ({
 			expect,
 		}) => {
-			const longValue = "a".repeat(1025);
+			const longValue = "a".repeat(65537);
 			let err: undefined | Error;
 			try {
 				await runWrangler(
@@ -345,7 +345,7 @@ describe("secrets-store secret commands", () => {
 				err = e as Error;
 			}
 			expect(err?.message).toMatchInlineSnapshot(
-				`"Secret value cannot exceed 1024 characters (got 1025). The Cloudflare API rejects longer values, and a binding to such a secret will fail at deploy time."`
+				`"Secret value cannot exceed 65536 bytes (got 65537). The Cloudflare API rejects longer values, and a binding to such a secret will fail at deploy time."`
 			);
 		});
 	});
diff --git a/packages/wrangler/src/secrets-store/commands.ts b/packages/wrangler/src/secrets-store/commands.ts
@@ -775,12 +775,13 @@ export const validateSecretName = (name: string) => {
 	}
 };
 
-export const MAX_SECRET_VALUE_LENGTH = 1024;
+export const MAX_SECRET_VALUE_BYTES = 64 * 1024;
 
 export const validateSecretValue = (value: string) => {
-	if (value.length > MAX_SECRET_VALUE_LENGTH) {
+	const byteLength = Buffer.byteLength(value, "utf8");
+	if (byteLength > MAX_SECRET_VALUE_BYTES) {
 		throw new UserError(
-			`Secret value cannot exceed ${MAX_SECRET_VALUE_LENGTH} characters (got ${value.length}). The Cloudflare API rejects longer values, and a binding to such a secret will fail at deploy time.`,
+			`Secret value cannot exceed ${MAX_SECRET_VALUE_BYTES} bytes (got ${byteLength}). The Cloudflare API rejects longer values, and a binding to such a secret will fail at deploy time.`,
 			{ telemetryMessage: "secrets store secret value too long" }
 		);
 	}
