SECENG-12857: Increase secrets-store max value length from 1024 to 2048 characters

[BattlefieldDuck]

Describe the solution

Issue

npx wrangler secrets-store secret create <store-id> --name DKIM_PRIVATE_KEY --value <value> --scopes workers

 Creating secret... (Name: DKIM_PRIVATE_KEY, Value: REDACTED, Scopes: workers, Comment: undefined)

X [ERROR] A request to the Cloudflare API (/accounts/<accounts>/secrets_store/stores/<stores>/secrets) failed.

  secret_value_too_long [code: 1001]

  If you think this is a bug, please open an issue at:
  https://github.com/cloudflare/workers-sdk/issues/new/choose

I had a old email worker that use secret, and now I am trying to use the new secrets store on Cloudflare.
My worker secret DKIM_PRIVATE_KEY is 1624 long, which is longer than 1024 characters, but it reaches the limit value length of the secrets store.

Possible solution

I hope it can increase the limit to 2048 characters.

Current solution

Using the old secret env var on the worker, or creating DKIM_PRIVATE_KEY_1 and DKIM_PRIVATE_KEY_2 for splitting the secret value :(

[penalosa]

I've pinged the relevant team internally

[BattlefieldDuck]

Secret Size Limits Comparison

Provider	Service	Max Secret Size (Per Secret)
AWS	Secrets Manager	65 KB
Google Cloud	Secret Manager	64 KB
Azure	Key Vault – Secrets	25 KB
Cloudflare	Secrets Store	1 KB

Observation

Compared to other popular platforms, Cloudflare's 1 KB secret size limit is extremely restrictive. For many use cases, this limit is sufficient for small tokens or API keys, but it quickly becomes a limitation for more complex secrets, such as:

• JWT private keys

• Long API credentials

• Encrypted payloads

Suggestion

It would be highly beneficial if Cloudflare:

• Increased the secret size limit (even moderately)

• Provided higher limits for Workers Paid plan

Conclusion

While Cloudflare's edge environment emphasizes lightweight, minimal resource usage, relaxing the current 1 KB limit — at least for advanced plans — would greatly improve developer flexibility without compromising performance for typical workloads.

[CarmenPopoviciu]

I see an internal ticket (SECENG-12857) was raised for this issue, but there's no consensus around raising the limits yet, so a response is still pending from our side 🙏

[cdgco]

I'm running into a similar issue trying to add a GCP service account key to secrets store which is around 2300 characters.

[benjamingregory]

+1 to longer secret length. have run into private keys being too long multiple times

[austinstoker]

+1, we are running into this limit for several keys

[petebacondarwin]

There is an internal ticket tracking this (SECENG-12857). Pinging them again.

[andy-culshaw]

We have had to go down the route of splitting the credential into 1024 byte chunks - also for the GCP service account key. So adding my +1 here

[Foxtrio]

+1. Have to split GCP Service key 😑

[rockingrohit9639]

+1

[anas-afzal]

+1

[AmmarKhalid123]

+1

[aB33p]

+1

[SouhailRAZZOUK]

+1

[MattieTK]

I have pinged the internal team again asking for an update and referencing these recent notes of splitting credentials across multiple secrets as a workaround.

[saranw71]

+1 Having to split the key

[BattlefieldDuck]

This issue seems to be the main reason why large projects are deterred from deploying on Cloudflare Workers.
I hope this can be addressed as soon as possible.