Secrets and environments

Performance tests need credentials: API tokens, service-account passwords, webhook signing keys. They often run against more than one environment too (staging, pre-prod, production). This page shows how to keep secrets out of test files and how to point one test at different environments safely.

Never embed secrets in test files

Anything you put in a Taurus YAML, JMeter scenario or k6 script ends up in the run bundle. Anyone with access to the test can see it. This is true whether a person or an AI agent writes the file. If an AI agent generates your tests (see Connect AI tools), tell it to reference secrets by name, never by value.

Manage secrets and schedules.

Why not inline

A token written into a test file:

• Is stored in your project (and in version control, if you upload from a repo).
• Appears in the run bundle, which every teammate with project access can download.
• Needs a test-file edit and re-upload to rotate, instead of a change to one value.

Project secrets fix all three. MaxoPerf stores the value encrypted, injects it at run time and redacts it from run output.

How project secrets work

• A project secret is a named, encrypted value stored at the project level.
• Each test binds the secrets it needs and maps each one to an environment-variable name.
• At run time, MaxoPerf injects those variables into the runner before your test starts.
• The runtime payload is short-lived and belongs to a single run.

Secrets hub. Open each workspace's encrypted vault from here.

Create and bind a secret

1. Open the project that owns the test, switch to the Secrets tab and click New secret. Give it a clear name, like checkout-api-token.
2. Paste the value. MaxoPerf encrypts it when you save.
3. Open the test’s Dependencies tab and bind the secret. Pick it from the picker, then choose the environment-variable name the test expects.

Environment variable name must start with SECRET_

The bound variable name must match ^SECRET_[A-Za-z0-9_]{1,120}$, for example SECRET_CHECKOUT_API_TOKEN. MaxoPerf rejects bindings that don’t match.

Read the variable in your test files as usual:

• Taurus: ${__env(SECRET_CHECKOUT_API_TOKEN)}
• k6: __ENV.SECRET_CHECKOUT_API_TOKEN
• JMeter: ${__BeanShell(System.getenv("SECRET_CHECKOUT_API_TOKEN"))}

Manage test secrets covers the full secrets workflow, including rotation.

Running the same test across environments

The pattern that keeps a token out of a test file also keeps environment-specific values out of it (base URLs, tenant IDs, feature-flag keys):

• Bind an environment-specific value, such as a staging or production base URL, the way you bind a secret. The test reads a named variable at run time instead of a value hardcoded into the scenario.
• Keep one test definition per scenario and change only the bound values per run. Don’t keep near-duplicate test files per environment. The request flow or user journey then lives in one place, and a change to the scenario doesn’t have to be copied into each environment’s file.
• Use one naming convention across environments (checkout-api-token-staging, checkout-api-token-prod). You can then see which secret backs which run. This matters most when an AI agent picks the secret to bind.

Workspace secrets. The list shows names and versions only. MaxoPerf never returns a value once it is stored, so a per-environment naming convention is how you tell secrets apart.

For AI agents generating or running tests

When asked to run a test “against staging” or “against prod,” bind the secret and variable for that environment. Don’t ask for a raw credential or put one in the request. If the request names no environment, ask which one before running. A test aimed at the wrong environment can put real load on production.

What never happens

• Secret values are never written to result pages, run logs, or downloaded artifact bundles.
• Secret values are never available to teammates without project-level access.
• The runner never logs secret values. Only the names of injected variables appear in diagnostic output.

Where to go next

• Manage test secrets: the full secrets UI walkthrough, including rotation.
• Get an API key: the MaxoPerf account credential, which you keep out of test files the same way.
• Connect AI tools: tell an agent to follow this pattern when it generates tests.