Cloudflare Workers AI agent API key management: vault keys for edge AI workflows

Cloudflare's AI agent primitives and where credentials fit

Cloudflare has assembled a set of primitives for building AI agents at the edge:

• Workers AI — run inference on Cloudflare's GPU network directly from a Worker. Used for intent classification, text generation, and embedding generation at low latency.
• Cloudflare Workflows — multi-step, durable workflow orchestration built into the Workers runtime. Each step is a Worker function with retry semantics. The equivalent of Temporal or Prefect for Workers.
• AI Gateway — a Cloudflare-managed LLM proxy that adds rate limiting, caching, and observability for calls to OpenAI, Anthropic, and other LLM providers. Analogous to Keybrake but for LLM endpoints, not vendor SaaS APIs.
• Durable Objects — stateful edge compute; holds agent conversation state, pending actions, and workflow progress in a single strongly-consistent object.
• Workers Secrets — encrypted environment variables bound to a Worker; the right place to store the Keybrake API token used to issue vault keys.

AI Gateway handles LLM API key governance. Keybrake handles vendor SaaS API key governance (Stripe, Twilio, Resend). They're complementary: an AI agent can route its LLM calls through AI Gateway and its Stripe calls through Keybrake simultaneously.

The vault key pattern for Cloudflare Workers

// Worker: issue vault key, proxy Stripe call, revoke key
export default {
  async fetch(request: Request, env: Env): Promise {
    const body = await request.json() as { customerId: string; amountCents: number };
    const workflowId = request.headers.get("X-Workflow-Id") ?? crypto.randomUUID();

    // Step 1: Issue vault key using the Keybrake token from Workers Secrets
    const keyRes = await fetch("https://api.keybrake.com/v1/keys", {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${env.KEYBRAKE_TOKEN}`,  // from Workers Secret
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        label: `workers-charge-${workflowId}`,
        vendor: "stripe",
        allowed_endpoints: [
          "/v1/payment_intents",
          "/v1/payment_intents/*"
        ],
        daily_usd_cap: 500,
        expires_in: "5m"
      }),
    });

    if (!keyRes.ok) {
      return new Response(JSON.stringify({ error: "vault_key_issuance_failed" }), {
        status: 500, headers: { "Content-Type": "application/json" }
      });
    }

    const { token: vaultKey, id: keyId } = await keyRes.json() as { token: string; id: string };

    try {
      // Step 2: Proxy Stripe call through Keybrake using the vault key
      const stripeRes = await fetch(
        "https://proxy.keybrake.com/stripe/v1/payment_intents",
        {
          method: "POST",
          headers: {
            "Authorization": `Bearer ${vaultKey}`,  // vault key, not Stripe secret
            "Content-Type": "application/json",
          },
          body: JSON.stringify({
            amount: body.amountCents,
            currency: "usd",
            customer: body.customerId,
          }),
        }
      );

      if (stripeRes.status === 429) {
        const err = await stripeRes.json() as { code?: string };
        if (err.code === "cap_exhausted") {
          return new Response(
            JSON.stringify({ error: "spend_cap_exceeded" }),
            { status: 402, headers: { "Content-Type": "application/json" } }
          );
        }
      }

      const payment = await stripeRes.json();
      return new Response(JSON.stringify(payment), {
        status: stripeRes.status,
        headers: { "Content-Type": "application/json" }
      });

    } finally {
      // Step 3: Revoke vault key — fire and forget (TTL is safety net)
      await fetch(`https://api.keybrake.com/v1/keys/${keyId}`, {
        method: "DELETE",
        headers: { "Authorization": `Bearer ${env.KEYBRAKE_TOKEN}` },
      });
    }
  }
};

Vault keys in Cloudflare Workflows

Cloudflare Workflows provides durable multi-step orchestration with automatic retry. Each workflow step is a distinct execution unit — vault keys should be issued per step rather than per workflow, because a workflow can span minutes to hours and individual steps are independently retried:

import { WorkflowEntrypoint, WorkflowStep, WorkflowEvent } from 'cloudflare:workers';

interface BillingWorkflowParams {
  customerId: string;
  amountCents: number;
  runId: string;
}

export class BillingWorkflow extends WorkflowEntrypoint {
  async run(event: WorkflowEvent, step: WorkflowStep) {
    const { customerId, amountCents, runId } = event.payload;

    // Issue a vault key scoped to this workflow step (not the entire workflow)
    const vaultKey = await step.do("issue-vault-key", async () => {
      const res = await fetch("https://api.keybrake.com/v1/keys", {
        method: "POST",
        headers: { "Authorization": `Bearer ${this.env.KEYBRAKE_TOKEN}` },
        body: JSON.stringify({
          label: `workflow-${runId}-charge-step`,
          vendor: "stripe",
          allowed_endpoints: ["/v1/payment_intents", "/v1/payment_intents/*"],
          daily_usd_cap: 1000,
          expires_in: "10m"  // Longer TTL for workflow steps with retry
        }),
      });
      const key = await res.json() as { token: string; id: string };
      return key;
    });

    // Charge the customer using the per-step vault key
    const payment = await step.do("charge-customer", async () => {
      const res = await fetch("https://proxy.keybrake.com/stripe/v1/payment_intents", {
        method: "POST",
        headers: { "Authorization": `Bearer ${vaultKey.token}` },
        body: JSON.stringify({ amount: amountCents, currency: "usd", customer: customerId }),
      });
      return await res.json();
    });

    // Revoke the step's vault key
    await step.do("revoke-vault-key", async () => {
      await fetch(`https://api.keybrake.com/v1/keys/${vaultKey.id}`, {
        method: "DELETE",
        headers: { "Authorization": `Bearer ${this.env.KEYBRAKE_TOKEN}` },
      });
    });

    return payment;
  }
}

Cloudflare AI Gateway vs. Keybrake: complementary, not competing

Durable Objects for vault key state caching

For high-throughput Workers that process many short requests (e.g., a webhook handler receiving thousands of events per minute), issuing a vault key per-request adds overhead. Durable Objects can cache vault keys for a session or user, reducing issuance to once per session rather than once per request:

// Durable Object: caches vault key for a user session
export class AgentSession extends DurableObject {
  private vaultKey: { token: string; id: string; expiresAt: number } | null = null;

  async getVaultKey(env: Env): Promise {
    const now = Date.now();

    // Reuse cached key if it expires more than 2 minutes from now
    if (this.vaultKey && this.vaultKey.expiresAt > now + 120_000) {
      return this.vaultKey.token;
    }

    // Issue new vault key (15-minute session key, reused across requests)
    const res = await fetch("https://api.keybrake.com/v1/keys", {
      method: "POST",
      headers: { "Authorization": `Bearer ${env.KEYBRAKE_TOKEN}` },
      body: JSON.stringify({
        label: `session-${this.ctx.id}`,
        vendor: "stripe",
        allowed_endpoints: ["/v1/payment_intents", "/v1/payment_intents/*"],
        daily_usd_cap: 200,  // Per-session cap
        expires_in: "15m"
      }),
    });

    this.vaultKey = await res.json() as { token: string; id: string; expiresAt: number };
    return this.vaultKey.token;
  }
}

Get early access

Related questions

Further reading

• Deno Deploy AI agent API key — the same vault key pattern for Deno Deploy's V8-isolate serverless runtime, which shares similar per-invocation isolation properties with Cloudflare Workers.
• AI agent API key lifecycle — how vault key TTL and revocation work as lifecycle phases aligned to the Cloudflare Workflow step lifecycle.
• AI agent budget enforcement — why per-call spend caps are distinct from cloud billing alarms, and how the atomic enforcement model works in the proxy layer.
• AI agent webhook authentication — authenticating Cloudflare Workers webhook handlers that trigger agent runs, ensuring the vault key is issued only for authenticated webhook deliveries.
• AI agent observability — how to correlate Keybrake audit log entries (vendor API calls) with Cloudflare Workers observability (request traces, Worker CPU time) for end-to-end agent run visibility.