first run — choose a strong passphrase to generate your key
Add this to wrangler.toml and redeploy:
wrangler.toml