nikivdev/code · error · anyhow::Error

No bootstrap secrets configured. Add cloudflare.bootstrap_se

Error message

No bootstrap secrets configured. Add cloudflare.bootstrap_secrets to flow.toml.

What it means

Thrown by the Cloudflare bootstrap secrets command when the `[cloudflare]` section exists in flow.toml but its `bootstrap_secrets` table is empty. The library requires at least one bootstrap secret to run the interactive secret-entry flow, so it aborts early with a message telling the user exactly what to add. It guards against proceeding with nothing to bootstrap.

Source

Thrown at src/env.rs:2660

        let is_secret = !var_keys.contains(&key);
        let value = prompt_value(&key, default_value, is_secret)?;

        if let Some(value) = value {
            set_project_env_var(&key, &value, environment, None)?;
        }
    }

    Ok(())
}

fn bootstrap_cloudflare_secrets(project_root: &Path, cfg: &config::Config) -> Result<()> {
    let cf_cfg = cfg
        .cloudflare
        .as_ref()
        .context("No [cloudflare] section in flow.toml")?;

    if cf_cfg.bootstrap_secrets.is_empty() {
        bail!("No bootstrap secrets configured. Add cloudflare.bootstrap_secrets to flow.toml.");
    }

    println!("Bootstrap Cloudflare secrets");
    println!("─────────────────────────────");
    println!("Enter values (leave empty to skip).");

    let mut values = HashMap::new();
    let mut generated_env_token: Option<String> = None;
    let needs_env_account = cf_cfg.bootstrap_secrets.iter().any(|key| {
        key == "JAZZ_APP_ID"
            || key == "JAZZ_BACKEND_SECRET"
            || key == "JAZZ_ADMIN_SECRET"
            || key == "JAZZ_WORKER_ACCOUNT"
            || key == "JAZZ_WORKER_SECRET"
    });
    let needs_auth_account = cf_cfg.bootstrap_secrets.iter().any(|key| {
        key == "JAZZ_AUTH_APP_ID"
            || key == "JAZZ_AUTH_BACKEND_SECRET"

View on GitHub (pinned to a747e741ae)

Solutions

1. Add the required secret names under `cloudflare.bootstrap_secrets` in flow.toml, e.g. `bootstrap_secrets = { API_TOKEN = "", WORKER_KV_KEY = "" }`
2. Run `f env bootstrap-cloudflare` again and enter the secret values interactively
3. If bootstrap secrets are intentionally absent, remove the empty [cloudflare] section or don't run the bootstrap command

Example fix

// before (flow.toml)
[cloudflare]
account_id = "abc123"

// after (flow.toml)
[cloudflare]
account_id = "abc123"

[cloudflare.bootstrap_secrets]
CLOUDFLARE_API_TOKEN = ""

let cf = cfg.cloudflare.as_ref().ok_or_else(|| anyhow!("No [cloudflare] section"))?;
if cf.bootstrap_secrets.is_empty() {
    anyhow::bail!("cloudflare.bootstrap_secrets must define at least one key before bootstrap");
}

fn has_bootstrap_secrets(cf: Option<&CloudflareConfig>) -> bool {
    cf.map(|c| !c.bootstrap_secrets.is_empty()).unwrap_or(false)
}

match run_bootstrap() {
    Err(e) if e.to_string().contains("bootstrap_secrets") => {
        eprintln!("Fix flow.toml: add [cloudflare.bootstrap_secrets] keys");
    }
    Err(e) => return Err(e),
    Ok(v) => v,
}

When it happens

Trigger: Running the bootstrap Cloudflare secrets subcommand when flow.toml contains a `[cloudflare]` section whose `bootstrap_secrets` map is missing or has zero entries (`cf_cfg.bootstrap_secrets.is_empty()`).

Common situations: Fresh project setup where the developer added `[cloudflare]` with an account/token but forgot the bootstrap_secrets keys; a scaffolded flow.toml with an empty `bootstrap_secrets = {}` placeholder; secrets removed during config cleanup but the bootstrap command was still invoked.

Related errors

• No [cloudflare] or [storage] env keys configured in flow.tom
• expected [{}] to be a table in global flow config
• No URL configured in [cloudflare]. Add 'url = "https://..."'
• No proxy targets configured. Add [[proxies]] to flow.toml
• No profile selected.

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/d096bb5ede3da32f. Report an issue: GitHub.