Environments, variables and secrets for API testing

Variable scopes

A {{variable}} is resolved from the most specific scope that defines it:

1. local variables set by scripts for the current request
2. data values from the current row of a data file in a run
3. the active environment
4. collection variables
5. globals for the whole workspace

Variables work in URLs, params, headers, bodies, auth fields and protocol settings. In the editor they are highlighted, autocompleted as you type, and flagged in red when they do not resolve, and an environment quick-look shows every value in play.

Environments that stay organised

Create an environment per stage, give each a colour tag so production stands out in the selector, pin the environments relevant to a collection so they are listed first, and set a default environment that activates when you open the collection's requests.

Initial and current values

Every variable has an initial value, which is shared with your team, and a current value, which stays on your device. Current values are stripped before anything is stored on the server, so you can put your personal token in a current value without it ever reaching the shared workspace. Variables marked as secret are masked in the UI.

Dynamic values

Built-in dynamic variables generate fresh data on every send, useful for unique ids and realistic test payloads:

{
  "id": "{{$guid}}",
  "email": "{{$randomEmail}}",
  "name": "{{$randomFirstName}}",
  "city": "{{$randomCity}}",
  "createdAt": "{{$isoTimestamp}}",
  "attempt": {{$randomInt}}
}

Scripts can set variables at any scope too, for example swc.environment.set("token", swc.response.json().access_token).

An encrypted vault for secrets

The vault keeps secrets encrypted on your device with a passphrase (PBKDF2-SHA256 key derivation and AES-256-GCM). Reference a secret as {{vault:name}}. Each secret can be limited to a list of allowed domains, so it is only sent to the hosts you intend. Secrets can also be linked to an external provider (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or 1Password Connect) and are fetched only when a request references them. Scripts can read vault secrets with swc.vault.get(name) only if you enable that.

Find secrets before they leak

The secret scanner checks collections, environments and globals for values that look like API keys, tokens, passwords and private keys, in URLs, headers, bodies, auth settings, scripts and variable values. Each finding has a severity and a location, can be moved into the vault in one step, and is flagged when it is exposed through a public workspace or published documentation.

The secret guard is on by default: saving a request that holds a token, key or password as plain text shows a warning with a shortcut to the scanner, the export dialog says how many secrets a file would carry before you download it, and the History panel can delete the entries that recorded one.

Run as a different user

Roles let you send the same requests as an admin, a normal user or a guest without editing them. Define the roles on a collection's Roles tab, each with its own variables (an email and password, say) and optionally the request that signs in. Then pick one with Run as, next to the environment selector. A role's values take precedence over the environment. A role with a sign-in request fetches its token before the first send, again shortly before a JWT expires, and again if the API answers 401, then retries once. A guest role sends without auth. Role definitions are shared with the collection; passwords typed as current values and the tokens stay on your device.

How it works

1. In the app, create an environment and add variables such as baseUrl and token.
2. Use them in requests as {{baseUrl}} and switch environments from the selector.
3. Move real credentials into current values or the vault, and run the secret scanner before sharing. Sharing and syncing environments needs a free account.

Frequently asked questions

Are my current values sent to the server?

They are not stored on the server. When you send a request through the web app, the values needed for that request are used to build it, but current values are stripped from anything saved to a shared workspace.

Can I import Postman environments?

Yes, along with globals and full data dumps. See import and export.

Where is the vault stored?

Encrypted in your browser's storage on your device. Decrypted secrets exist only in memory while the vault is unlocked.

What happens if a variable is missing?

The editor marks it in red as unresolved before you send, and the console shows the exact URL and headers that went out, so a missing value is easy to spot.