Add API Keys and Secrets

Variables and secrets are stored per project in Settings → Variables & Secrets and made available to generation and test runs at runtime. Secrets are write-only: once saved, the value is never displayed back.

Secrets Vs Variables

Type	Use for	Visibility
Secret	API keys, passwords, tokens, private credentials.	Hidden after saving.
Variable	Non-sensitive configuration values such as URLs or feature flags.	Stored as plain text.

Use a secret whenever the value should not appear in logs, screenshots, or shared docs.

Add A Value

1. Select Settings from the navigation rail.
2. Select Variables & Secrets under Project.
3. Add the name and value in the Variables or Secrets list and save.

Use clear names that are easy to recognize later, such as TEST_USER_EMAIL, TEST_USER_PASSWORD, or STAGING_API_TOKEN.

Use Values In Tests

Reference values from Gherkin steps with runtime tokens — type @ in the editor to autocomplete the names:

When I sign in with username "{{var:TEST_USER_EMAIL}}" and password "{{secret:TEST_USER_PASSWORD}}"

The token is resolved at run time inside the sandbox; the secret value never appears in the feature file, generation context, or run logs.

Common Uses

Value	Example use
Login username / password	Signing in before testing a protected flow.
Test account token	Calling a setup API before browser steps.
Plugin configuration	API keys required by installed plugins.

Safe Handling Tips

• Do not paste API keys or passwords directly into test instructions — use a {{secret:...}} token.
• Do not store passwords as variables.
• Rotate keys if they were copied into the wrong place.
• Use dedicated test accounts rather than personal credentials.

Troubleshooting

If generation or a run reports a missing value, confirm the token name matches the entry in Variables & Secrets exactly. See Missing secrets.