Use secrets

Store credentials outside your code, and mark them as secret when you type them.

Read passwords and tokens from environment variables, never from the test file.
Type them with secret: true so TestDriver doesn’t log or store them.

Type a secret

Pass { secret: true } to type() for any sensitive value. Click the field first, then type:

tests/login.test.mjs

import { expect, it } from 'vitest';
import { TestDriver } from 'testdriverai/vitest/hooks';

it('signs in', async (context) => {
  const testdriver = TestDriver(context);
  await testdriver.provision.chrome({ url: `${process.env.APP_URL}/login` });

  const usernameField = await testdriver.find('Username input field');
  await usernameField.click();
  await testdriver.type(process.env.TEST_USERNAME);

  const passwordField = await testdriver.find('Password input field');
  await passwordField.click();
  await testdriver.type(process.env.TEST_PASSWORD, { secret: true });

  const signInButton = await testdriver.find('Sign in button below the password field');
  await signInButton.click();

  const result = await testdriver.assert('the dashboard is visible');
  expect(result).toBe(true);
});

What `secret: true` hides

With secret: true, TestDriver replaces the text with ****:

In the SDK’s console output.
In the record of the action that TestDriver stores for the test run.

The text is still typed into the sandbox, so secret: true can’t hide what the screen shows. If the field displays its contents, the value appears in the Dashcam recording and in screenshots. Password fields usually mask what you type, but plain text fields don’t.

With autoScreenshots on, screenshot file names include the first characters of the typed text, even when secret is true. Leave autoScreenshots off in tests that type secrets.

Store secrets locally

TestDriver loads a .env file in your project root automatically. Put your local credentials there:

.env

TD_API_KEY=your_api_key
APP_URL=https://staging.example.com
TEST_USERNAME=qa@example.com
TEST_PASSWORD=your_test_password

Add .env to .gitignore so it’s never committed:

.gitignore

.env

Store secrets in CI

In GitHub Actions, store each credential as a repository secret:

Open your repository's secrets

In GitHub, go to Settings > Secrets and variables > Actions.

Add each secret

Click New repository secret and add TEST_USERNAME and TEST_PASSWORD.

Pass them to the test step

Map the secrets to environment variables in your workflow:

.github/workflows/testdriver.yml

- name: Run TestDriver tests
  run: npx vitest run
  env:
    APP_URL: https://staging.example.com
    TEST_USERNAME: ${{ secrets.TEST_USERNAME }}
    TEST_PASSWORD: ${{ secrets.TEST_PASSWORD }}

You don’t need to store your TestDriver API key this way. The testdriverai/action step authenticates with GitHub OIDC. See Run in CI/CD for the full workflow.

Checklist

Type passwords, tokens, and other sensitive values with secret: true.
Read credentials from environment variables, not from the test file.
Keep .env out of version control.
Use test accounts with only the access your tests need.

Next steps

Use variables and test data

Drive tests with environment variables and fixtures.

type()

Every option for typing text.

Run in CI/CD

Authenticate and run tests in your pipeline.

Reuse code

Put your login steps in a shared helper.

Overview

Using TestDriver

Building & maintaining tests

Advanced topics

Type a secret

What `secret: true` hides

Store secrets locally

Store secrets in CI

Checklist

Next steps

Use variables and test data

type()

Run in CI/CD

Reuse code

​Type a secret

​What secret: true hides

​Store secrets locally

​Store secrets in CI

​Checklist

​Next steps

Use variables and test data

type()

Run in CI/CD

Reuse code

Type a secret

What `secret: true` hides

Store secrets locally

Store secrets in CI

Checklist

Next steps