Secrets, logs and migrations

Secrets

The Secrets card lists the deployed Worker’s secret names, and adds, replaces or deletes secrets.

• Write-only. A value goes to wrangler secret put on standard input, never on a command line. It’s never stored, logged or shown, and can’t be read back.
• Deleting a secret asks first.

For local secrets, use .dev.vars.

Live production logs

Live production logs streams wrangler tail into a table: outcome, method, path, status and colo, with each request’s console.log lines and exceptions.

Filters at the source are applied by Cloudflare before events reach you, using wrangler tail’s own flags:

Filter	Flag
Outcome: ok, error, canceled	--status
Method	--method
Text in console.log	--search
Sampling: 100, 50, 10 or 1%	--sampling-rate
Only my IP	--ip self

Changing them offers Restart with filters.

Show filters apply in Flarebox to what has already arrived: status class or exception, method or CRON, path, and text anywhere in the URL, logs or exceptions.

Pause freezes the list and counts what arrives meanwhile. Export as JSONL saves the events in view, one JSON object per line, exactly as wrangler sent them.

Analytics from the tail

Requests per minute, the 5xx share, exceptions, colos and the busiest routes, computed live from the tail stream. No API token needed. It’s a sample of live traffic, not account analytics. For those, see Workers in production.

D1 migrations in production

On the Explorer’s migrations bar, Remote… lists the migrations the production database hasn’t applied (d1 migrations list --remote, read-only).

Applying them:

• needs a tick every time: “I want to change the production database … now”;
• runs wrangler d1 migrations apply <db> --remote [--env], and wrangler captures a backup;
• shows the exact wrangler d1 time-travel restore <db> --timestamp=… command to undo it, with the time the dialog opened;
• goes into History and raises a notification, like a deploy.

D1’s error codes are explained in words. For example, 7404 means no database has this database_id.