Secrets
Use Worker Secrets, environment variables or a secret store. Rotate exposed credentials.
Security
Assume every public endpoint will eventually be probed.
Security is not only “hide the password.” A safe bot authenticates callers, validates input, limits permissions, protects secrets, records decisions and fails safely.
The five rules
Keep secrets out of public code. Authenticate public requests. Validate every external value. Give credentials the minimum permissions needed. Make uncertain failures stop safely rather than repeating important actions.
Practical example
Real example: invalid Turnstile secret
A form can render a successful browser challenge while the backend still rejects it. In one setup, Siteverify returned invalid-input-secret; replacing the Worker secret fixed the server-side verification.
Webhooks
A hidden URL alone is not authentication. Use a secret/signature and reject replays.
Inputs
Check schema, type, allowed values, age and event ID before business logic.
Permissions
Prefer read-only or narrowly scoped credentials where possible.
Logs
Record decisions without authorization headers, passwords or private tokens.
Failure
Timeout does not always mean “nothing happened.” Verify state before retrying an important action.
Public forms need abuse protection too
A community form or contact endpoint should combine server-side validation with anti-bot controls. A browser widget is not enough by itself; the backend must verify the token before accepting the submission.
Read next
Common questions
Is a secret webhook URL enough security?
No. URLs leak through logs, browser history and screenshots. Use explicit authentication or signatures and validate every request.
Why is a timeout dangerous for order retries?
A timeout tells you the response was uncertain, not necessarily that the remote system did nothing. Check external state before repeating an important action.
What should logs exclude?
Passwords, API secrets, full authorization headers, private tokens and any unnecessary personal information.