> For the complete documentation index, see [llms.txt](https://docs.testvibe.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.testvibe.com/workspace/add-api-keys-and-secrets.md).

# Add API Keys and Secrets

Variables and secrets are stored per project in **Settings → Variables & Secrets** and made available to generation and test runs at runtime. Secrets are write-only: once saved, the value is never displayed back.

![The Variables & Secrets settings panel](/files/6DLMSqIifVVCqMYzDema)

## Secrets Vs Variables

| Type     | Use for                                                           | Visibility            |
| -------- | ----------------------------------------------------------------- | --------------------- |
| Secret   | API keys, passwords, tokens, private credentials.                 | Hidden after saving.  |
| Variable | Non-sensitive configuration values such as URLs or feature flags. | Stored as plain text. |

Use a secret whenever the value should not appear in logs, screenshots, or shared docs.

## Add A Value

1. Select **Settings** from the navigation rail.
2. Select **Variables & Secrets** under Project.
3. Add the name and value in the Variables or Secrets list and save.

Use clear names that are easy to recognize later, such as `TEST_USER_EMAIL`, `TEST_USER_PASSWORD`, or `STAGING_API_TOKEN`.

## Use Values In Tests

Reference values from Gherkin steps with runtime tokens — type `@` in the editor to autocomplete the names:

```gherkin
When I sign in with username "{{var:TEST_USER_EMAIL}}" and password "{{secret:TEST_USER_PASSWORD}}"
```

The token is resolved at run time inside the sandbox; the secret value never appears in the feature file, generation context, or run logs.

## Common Uses

| Value                     | Example use                                 |
| ------------------------- | ------------------------------------------- |
| Login username / password | Signing in before testing a protected flow. |
| Test account token        | Calling a setup API before browser steps.   |
| Plugin configuration      | API keys required by installed plugins.     |

## Safe Handling Tips

* Do not paste API keys or passwords directly into test instructions — use a `{{secret:...}}` token.
* Do not store passwords as variables.
* Rotate keys if they were copied into the wrong place.
* Use dedicated test accounts rather than personal credentials.

## Troubleshooting

If generation or a run reports a missing value, confirm the token name matches the entry in Variables & Secrets exactly. See [Missing secrets](/troubleshooting/missing-secrets.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.testvibe.com/workspace/add-api-keys-and-secrets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.