Add API Keys and Secrets

Variables and secrets are stored per project in Settings → Variables & Secrets and made available to generation and test runs at runtime. Secrets are write-only: once saved, the value is never displayed back.

Secrets Vs Variables

Type	Use for	Visibility
Secret	API keys, passwords, tokens, private credentials.	Hidden after saving.
Variable	Non-sensitive configuration values such as URLs or feature flags.	Stored as plain text.

Use a secret for sensitive values, and avoid exposing those values through test output, page content, or shared evidence.

Add A Value

1. Select Settings from the navigation rail.
2. Select Variables & Secrets under Project.
3. Add the name and value in the Variables or Secrets list and save.

Use clear names that are easy to recognize later, such as TEST_USER_EMAIL, TEST_USER_PASSWORD, or STAGING_API_TOKEN.

Use Values In Tests

Reference values from Gherkin steps with runtime tokens — type @ in the editor to autocomplete the names:

When I sign in with username "{{var:TEST_USER_EMAIL}}" and password "{{secret:TEST_USER_PASSWORD}}"

The token is resolved at runtime inside the execution environment, so the feature file can keep the reference rather than the value. TestVibe masks known secrets in its transcripts and logs. Avoid printing credentials or putting them in visible page content: application output and captured evidence can still expose information your test reveals.

Common Uses

Value	Example use
Login username / password	Signing in before testing a protected flow.
Test account token	Calling a setup API before browser steps.
Plugin configuration	API keys required by installed plugins.

Safe Handling Tips

• Do not paste API keys or passwords directly into test instructions — use a {{secret:...}} token.
• Do not store passwords as variables.
• Rotate keys if they were copied into the wrong place.
• Use dedicated test accounts rather than personal credentials.

Troubleshooting

If generation or a run reports a missing value, confirm the token name matches the entry in Variables & Secrets exactly. See Missing secrets.