Encryption Keys

New messages, attachments, and Telegram settings use server-side encryption at rest. The Worker decrypts after authorization. Historical plaintext remains readable as stored.

Default Operation

Actions generates keys on the first deployment. Normal deployments preserve existing Worker Secrets; leave both key options unchecked for ordinary updates.

Keys use independent versioned Secrets and an active key ID. Existing EDGECHAT_ENCRYPTION_KEYRING JSON keyrings remain supported.

Rotate the Write Key

1. Open Actions → 00 Deploy Worker → Run workflow.
2. Enable rotate_encryption_key and leave apply_encryption_keyring unchecked.
3. Wait for deployment to succeed.

The workflow adds a versioned Secret and switches the active key ID while retaining older keys. New data uses the new key; old data remains readable with its original key, without bulk re-encryption.

Keep Your Own Key Backup

Cloudflare cannot return Worker Secret values. To keep a complete backup, generate a random 32-byte AES key before first deployment and prepare:

{"activeKeyId":"v1","keys":{"v1":"BASE64_ENCODED_32_BYTE_KEY"}}

Back up the complete JSON offline and add it as the Repository Secret EDGECHAT_ENCRYPTION_KEYRING. A first deployment without existing keys uses it. For manual deployment:

npx wrangler secret put EDGECHAT_ENCRYPTION_KEYRING --config wrangler.toml

Paste the JSON at the prompt. Store keys only as Secrets and in offline backups.

Apply a Complete Keyring Manually

For an existing site:

1. Prepare a complete JSON keyring, retaining every key ID and original value referenced by historical data.
2. Add the new key and update activeKeyId.
3. Update the Repository Secret EDGECHAT_ENCRYPTION_KEYRING.
4. Run deployment with only apply_encryption_keyring enabled.

Losing old keys makes their messages, attachments, and Telegram settings unreadable. Automatically generated versioned keys cannot be exported from Cloudflare; use incremental automatic rotation for those deployments.