Store Passwords and API Keys Securely

Common use cases

Secrets are commonly used for:

• Passwords
• API keys
• Access tokens
• Client secrets
• Database credentials
• Authentication tokens

Creating a Secret

To create a Secret:

1. 1
   Open Data Config from the sidebar.
2. 2
   Select the Secrets tab.
3. 3
   Click New Secret.
4. 4
   Enter a unique name.
5. 5
   Enter the secret value.
6. 6
   Choose whether the Secret should be available globally or only for specific Environments.
7. 7
   Save the Secret.

Using Secrets

Secrets are referenced exactly like Variables using double curly braces.

{{stripeApiKey}}

Most supported fields include a Select from Variable or Secret button, allowing you to insert Secrets without typing their names manually.

Secret scope

Secrets support the same scoping options as Variables.

Global Secrets

Global Secrets are available throughout the entire project.

Examples include:

• Shared API keys
• Common authentication tokens
• Company-wide credentials

Environment-specific Secrets

Environment-specific Secrets allow different environments to use different credentials while keeping the same Secret name.

For example:

This allows the same Test Case to run against different environments without modification.

Updating Secrets

Unlike Variables, Secret values are write-only: TestOwl never shows a saved value again.

To change a Secret, edit it and enter a New Value to replace the old one. You can also change its name and scope. Any Test Case or Flow that references the Secret by name picks up the new value automatically.

Deleting Secrets

Deleting a Secret moves it to the Recycle Bin instead of permanently removing it.

Secrets remain in the Recycle Bin for 15 days and can be restored during that time, after which they are permanently deleted.

Security

TestOwl encrypts every Secret before storing it. Secret values are never displayed in the user interface after creation and are only accessed during test execution when required.

Best practices

• Store all passwords, API keys, and tokens as Secrets.
• Never store sensitive values in Variables.
• Use descriptive names such as stripeApiKey or adminPassword.
• Use Environment-specific Secrets when credentials differ between environments.
• Delete unused Secrets regularly to keep your project organised.

Next steps