# Add API Keys and Secrets

URL: https://docs.testvibe.com/workspace/add-api-keys-and-secrets

Variables and secrets are stored per project in **Settings → Variables & Secrets** and made available to generation and test runs at runtime. Secrets are write-only: once saved, the value is never displayed back.

![The Variables & Secrets settings panel](/assets/images/settings-variables-secrets-e6b3559b52a9df69ed97a2e5c525f651.png)

## Secrets Vs Variables

| Type | Use for | Visibility | Secret | API keys, passwords, tokens, private credentials. | Hidden after saving. | Variable | Non-sensitive configuration values such as URLs or feature flags. | Stored as plain text. 

Use a secret whenever the value should not appear in logs, screenshots, or shared docs.

## Add A Value

1. Select **Settings** from the navigation rail.
2. Select **Variables & Secrets** under Project.
3. Add the name and value in the Variables or Secrets list and save.
Use clear names that are easy to recognize later, such as `TEST_USER_EMAIL` , `TEST_USER_PASSWORD` , or `STAGING_API_TOKEN` .

## Use Values In Tests

Reference values from Gherkin steps with runtime tokens — type `@` in the editor to autocomplete the names:

```gherkin
When I sign in with username "{{var:TEST_USER_EMAIL}}" and password "{{secret:TEST_USER_PASSWORD}}"
```

The token is resolved at run time inside the sandbox; the secret value never appears in the feature file, generation context, or run logs.

## Common Uses

| Value | Example use | Login username / password | Signing in before testing a protected flow. | Test account token | Calling a setup API before browser steps. | Plugin configuration | API keys required by installed plugins. 

## Safe Handling Tips

- Do not paste API keys or passwords directly into test instructions — use a `{{secret:...}}` token.
- Do not store passwords as variables.
- Rotate keys if they were copied into the wrong place.
- Use dedicated test accounts rather than personal credentials.

## Troubleshooting

If generation or a run reports a missing value, confirm the token name matches the entry in Variables & Secrets exactly. See [Missing secrets](/troubleshooting/missing-secrets) .