CliCallSecrets

CliCallSecrets = Partial<{ CLI_SIGNING_SECRET: string; CLI_BEARER_TOKEN: string; CLI_API_KEY: string; CLI_API_KEY_HEADER: string; CLI_BASIC_USERNAME: string; CLI_BASIC_PASSWORD: string; }> & Record<string, string | undefined>

Secret bundle accepted by verifyCliCall. Pass your worker’s full env (e.g. c.env) or just the CLI_* subset — the verifier looks only at the keys it knows.