Setting up GitHub Secrets
Add the required secrets to your GitHub repository so the bao GitHub Action can deploy automatically.
The bao GitHub Action reads a set of secrets from your repository to authenticate with Cloudflare and configure your deployment. This guide walks through each required secret and where to find the values.
Before you start
You need a scoped Cloudflare API token. Create one here →
Open your repository settings
In your GitHub repository, go to Settings → Secrets and variables → Actions → New repository secret.
Add the required secrets
Add each of the following as a separate repository secret.
CLOUDFLARE_API_TOKEN (required)
The scoped API token you created in the previous guide. Used by the action to deploy Workers, create KV namespaces, and run D1 migrations.
CLOUDFLARE_ACCOUNT_ID (required)
Your Cloudflare Account ID. Found at dash.cloudflare.com → (any domain) → right sidebar, or at dash.cloudflare.com/profile.
POLAR_ACCESS_TOKEN (optional)
Required only if you enable the Polar payments plugin in bao.config.json. Obtain from your Polar dashboard under Settings → Developers → Access tokens.
POLAR_WEBHOOK_SECRET (optional)
Required only if you enable webhooks: true in the Polar plugin config. Found in your Polar dashboard under Settings → Webhooks.
Trigger your first deployment
Once secrets are in place, push to your main branch or manually trigger the Deploy workflow from the Actions tab.
The action will:
- Read your
bao.config.json - Provision a D1 database and KV namespace (first run only)
- Generate and encrypt a fresh auth secret, storing it in KV
- Deploy the auth service and rotation worker to Cloudflare Workers
All done!
Your auth service is live. The URL will be printed in the GitHub Actions log. Head to console.getbao.dev to configure plugins and manage your project.