Skip to main content
Jun needs one secret to run: SETUP_TOKEN. Everything else is optional and turns on a provider or integration. Bindings (database, storage, queue, AI) are created for you by the Deploy button or npm run deploy.

​
Worker secrets and variables

​
SETUP_TOKEN

Any passphrase of at least 16 characters. You type it once, on your first visit, to create the owner account and workspace. After that it’s used only on /recover, which lets the owner register a new passkey after losing every one. The Deploy button asks for it. Without it (or with a shorter one), setup fails with SETUP_TOKEN isn't configured (needs 16+ characters). Set it as a Worker secret. Keep it somewhere safe: anyone with it can add a passkey to the owner’s account. Changing it later is safe; only /recover uses it.

​
OPENAI_API_KEY

An OpenAI API key, used when Settings → AI has OpenAI as the provider. If the provider is OpenAI and the key is missing, every AI reply hands off to your team instead, and the brief says OPENAI_API_KEY isn't set. Add it as a Worker secret. See Models.

​
OPENAI_BASE_URL

Optional. Sends OpenAI requests to this base URL instead of OpenAI’s, for example a Cloudflare AI Gateway endpoint for logging, caching and rate limits.

​
JUN_SECRET_<NAME>

A key for your actions. An action file writes {secrets.ACME_API_KEY} in a header, and the desk fills it from JUN_SECRET_ACME_API_KEY:
actions/lookup_order.yaml
NAME is UPPER_SNAKE_CASE. Instead of a Worker secret, an admin can paste the key on the action’s page on the desk. When both exist, the Worker secret wins. See Actions.

​
GITHUB_TOKEN

A GitHub token for Create issue: a fine-grained personal access token for the one repository, with Issues: Read and write. Instead of the secret, an admin can paste it in Settings → Issue trackers; the secret wins. See Issues.

​
GITHUB_API_URL

Optional. The API address for GitHub Enterprise Server. Default https://api.github.com.

​
LINEAR_API_KEY

A Linear personal API key (Linear → Settings → Security & access). Instead of the secret, an admin can paste it in Settings → Issue trackers; the secret wins.

​
LINEAR_API_URL

Optional. Another Linear GraphQL endpoint. Default https://api.linear.app/graphql.

​
Set a secret

1

Open your Worker

In the Cloudflare dashboard, go to Workers & Pages and select your desk’s Worker (jun-desk unless you renamed it).
2

Add the secret

Open Settings → Variables and Secrets, press Add, choose type Secret, enter the name (for example OPENAI_API_KEY) and the value.
3

Deploy

Press Deploy. The Worker picks it up at once.
Set the URL settings (OPENAI_BASE_URL, GITHUB_API_URL, LINEAR_API_URL) as type Secret too. wrangler deploy keeps secrets, but replaces plain-text variables with the ones in wrangler.jsonc, which has none, so a plain-text variable added on the dashboard disappears on your next npm run deploy.
Secrets survive upgrades: npm run deploy never touches them.

​
Keys that aren’t Worker secrets

Some keys are created or pasted on the desk and kept by the desk itself:

​
Bindings

wrangler.jsonc declares these. The Deploy button and wrangler deploy create the resources; you don’t set IDs. One cron trigger runs every 15 minutes (topic labels for quiet chats); its 03:15 UTC run also re-syncs knowledge.
Two desks in one Cloudflare account must use different database, bucket and queue names. With the default names, a second Worker binds to the first desk’s jun-desk database, jun-desk-files bucket and jun-desk-crawl queue and shares its data. Change the names on the Deploy button’s form (for example jun-trial, jun-trial-files, jun-trial-crawl).

​
Local development

Both files are gitignored. See Local development.

Security

How the desk protects accounts, keys and customer data.

Deploy to Cloudflare

The Deploy button and the command line.