Configuration and secrets

Copy infra/cloudflare/.env.example into approved local or CI secret storage. Never commit a populated environment file or print its values in build logs.

Required production configuration

Variable	Purpose
CLOUDFLARE_ACCESS_ALLOWED_EMAILS	Exact comma-separated operator identities; at least one is required
SAPA_INSTALLATION_ID	Stable installation identity; never rotate for an existing data set
SAPA_INTERNAL_SECRET	Independent internal authentication secret
SAPA_SNAPSHOT_KEYRING	Encryption keyring for protected historical snapshots
SAPA_COMPANY_NAME	Merchant name used in customer-facing communication
RESEND_FROM_EMAIL	Verified transactional sender identity
RESEND_API_KEY	Resend credential
ALCHEMY_PASSWORD	Protects Alchemy deployment state

The snapshot keyring is a JSON document:

{
  "activeKeyId": "primary",
  "keys": [{ "keyId": "primary", "key": "<32-byte-unpadded-base64url>" }]
}

Retain old key entries while any stored snapshot references them. Rotate by adding a new key and changing activeKeyId; do not delete historical keys prematurely.

Optional providers

• Midtrans: MIDTRANS_SERVER_KEY and optional MIDTRANS_ENVIRONMENT.
• Polar USD one-time payments: POLAR_ACCESS_TOKEN, POLAR_WEBHOOK_SECRET, POLAR_PRODUCT_MAP, SAPA_PROVIDER_NOTIFICATION_BASE_URL, and optional POLAR_ENVIRONMENT. The base URL must be a public HTTPS origin ending in /api/provider-notifications. Configure its /polar endpoint for raw order.paid, order.refunded, and checkout.expired events.

Credentials are encrypted Worker secret bindings. Omitting one provider disables only that provider; SAPA does not silently fall back or convert currencies.

Signed customer actions

All SAPA_CUSTOMER_ACTION_* values must be configured together. The public base URL must use HTTPS and must not sit behind operator-only Cloudflare Access. Signing keys must remain server-side and must never appear in customer URLs, logs, or snapshots.

Sandbox isolation

The sandbox stage requires independent installation, internal, snapshot, payment, download, and automation secrets plus SANDBOX_TEST_EMAIL. Routine sandbox email is captured in append-only D1 storage and is rejected for every other recipient.

The sandbox runner requires both Cloudflare Access service-token headers and the independent automation bearer credential. Sandbox credentials must not be reused in production.

Secret invariants

• Raw license keys appear only in the first successful issuance or rotation response.
• Raw keys are not retained in logs, automation activity, offer snapshots, or browser telemetry.
• Provider payloads are authenticated before checkout lookup or lifecycle writes.
• Download links are signed, customer-bound, eligibility-bound, and time-bounded.
• Administrative and automation reads remain bounded.