Breadcrumbs

Team Secrets

Team Secrets let you store sensitive values such as passwords, API keys, tokens, PINs, and authentication secrets at the team level so Playwright tests can use them without hardcoding secret values in test code.

Secret values are encrypted at rest using AES-256-GCM and are not displayed in plain text after they are saved.

What can you do with Team Secrets?

With Team Secrets, you can:

  • Store named secret values at the team level.

  • Edit and delete existing secrets.

  • Retrieve secrets from Playwright tests using leapwork.variables.getSecret().

  • Use the same secret across Playwright tests within the team without putting the value directly into the test source.

Secret lookup is case-insensitive. For example, getSecret("MyKey") and getSecret("mykey") refer to the same secret.

How do you create a Team Secret?

  1. Open the team you want to manage by double-clicking the team name in the Explorer.

  2. Scroll to the Secrets section on the team page.

  3. Click + Add Secret.

  4. Enter a Secret name and Secret value.

  5. Press Enter or click away to save the secret.

The value is encrypted and masked immediately after it is saved.

How do you edit or delete a Team Secret?

To edit a secret, double-click the row or right-click it and select Edit secret. Enter the new value and save.

To delete a secret, right-click the row and select Delete secret, then confirm the deletion.

How do you use a Team Secret in Playwright?

Once a secret has been saved, a Playwright test within the same team can retrieve it using leapwork.variables.getSecret().

JavaScript
const apiKey = leapwork.variables.getSecret("my-api-key");
const dbPassword = leapwork.variables.getSecret("db-password");

The secret is retrieved during test execution rather than being written directly into the test source.

If the requested secret name does not exist, getSecret() returns an empty string.

How can Team Secrets be used for TOTP-based MFA?

Team Secrets can also store the shared secret used by a TOTP-based multi-factor authentication flow.

For example:

JavaScript
const mfaSecret = leapwork.variables.getSecret("mfa-secret");

const otp = leapwork.generateTOTP(mfaSecret);

await page
  .getByLabel("Verification code", { exact: true })
  .fill(otp);

This keeps the shared MFA secret out of the test source while allowing the TOTP to be generated during the test run.

Learn more about the complete authentication flow in How to Automate TOTP Authentication in Playwright.

Security

Team Secrets provide a central place for sensitive values used by tests.

According to the current Team Secrets implementation:

  • Secret values are encrypted with AES-256-GCM before being stored.

  • The encryption key is derived from a team-level seed and is not exposed to the client.

  • Saved values are displayed as masked previews (*****) in the UI.

  • Secret names are normalized to lowercase for lookup, preventing case-sensitive duplicates.

Tips for using Team Secrets

Use descriptive secret names so they are easy to identify and reference in tests. Keep secrets within the team that needs them rather than sharing the same value across teams.

For authentication secrets such as TOTP shared secrets, use a clear name such as mfa-secret and reference it through getSecret() rather than putting the value directly in the test.

image-20260812-110917.png