Variables
Store configuration, secrets, and data files securelyEdit
Variables give your tests configuration, credentials and test data at runtime.
Use file variables for non-sensitive test data and fixtures. Keep passwords, API keys, and tokens in Secrets, not inside uploaded files.
Variables vs Secrets vs Files
| Choose | Use for | Read in a test | Visibility |
|---|---|---|---|
| Variable | URLs, timeouts, configuration | getVariable('KEY') | Plain text in the dashboard and output. |
| Secret | Passwords, API keys, tokens | getSecret('KEY') | Encrypted at rest; revealing requires permission. Avoid logging it. |
| File | CSV, JSON, YAML, XML, TSV, or text fixtures up to 5 MB | Playwright: readFile('KEY'); k6: open(getFile('KEY')) during init | Uploaded test data; do not include credentials. |
Creating Variables
Open your project's Variables page and select Add Variable.
Choose the Type, then enter a Variable Name and its value.
| Type | Key example | Value |
|---|---|---|
| Variable (default) | BASE_URL | Plain text, e.g. https://staging.example.com |
| Secret | API_KEY | Text, encrypted and masked |
| File | TEST_DATA | Upload CSV, JSON, YAML, XML, TSV or plain text, max 5 MB |
Optionally add a description for your team, then select Add Variable.
Secret values are masked in the UI. Users with secret-view permission can reveal a value with the audited reveal action (refused while a super admin is impersonating a user). Converting a secret back to a variable requires a replacement value.
Using Variables in Tests
Access variables and secrets in your test code using the built-in functions:
Use for non-sensitive configuration:
// Basic usage
const baseUrl = getVariable('BASE_URL');
const timeout = getVariable('TIMEOUT');
// Navigate using variable
await page.goto(baseUrl + '/login');readFile() is for Playwright and other Node.js-based execution. k6 does not support readFile(). For k6, always use open(getFile('KEY')) during init context.
Secret Protection
Use getSecret() when a test needs a credential. Execution output masks secret values, but you should still avoid logging them:
// Avoid intentional secret logging in scripts
// Worker redaction is an additional protection layer for accidental output
console.log('API key configured:', !!getSecret('API_KEY'));
const actualKey = getSecret('API_KEY');Masking covers console output, error messages, and text report files (.html, .json, .txt, .md, .xml, up to 20 MB each). It does not cover traces, screenshots, videos, or the Playwright HTML report, whose test data is stored compressed inside the page. If a test types a secret into a page, the secret can appear in those artifacts. Do not type secrets into pages whose reports you share.
Secrets work normally in:
- Playwright actions (
page.fill(),page.click()) - HTTP headers and request bodies
- URL parameters
- Comparisons and conditionals
Common Patterns
const env = getVariable('ENVIRONMENT'); // 'staging' or 'production'
const baseUrl = getVariable(`${env.toUpperCase()}_URL`);
await page.goto(baseUrl);Best Practices
Security Features
Store credentials as Secrets to encrypt saved values. Editing a secret starts with an empty value field; leave it blank to keep the current value, or select Reveal current value to view it. Keep secrets out of uploaded data files.