Secrets and environments

Performance tests need credentials — API tokens, service-account passwords, webhook signing keys — and often need to run against more than one environment (staging, pre-prod, production). This page covers both: how to keep secrets out of test files, and how to point the same test at different environments safely.

Never embed secrets in test files

Anything committed to a Taurus YAML, JMeter scenario, or k6 script ends up in the run bundle and is visible to anyone with access to the test. This applies whether a human or an AI agent writes the file — if you’re using an AI agent to generate tests (see Connect AI tools), instruct it explicitly to reference secrets by name, never by value.

Why not inline

Inlining a token in a test file means:

• It’s committed to your project (and version control, if you upload from a repo).
• It shows up in the run bundle every teammate with project access can download.
• Rotating it means editing and re-uploading the test file, not just updating one value.

Project secrets solve all three: the value lives encrypted in MaxoPerf, is injected at run time, and is redacted from run output.

How project secrets work

• A project secret is a named, encrypted value stored at the project level.
• Each test binds the secrets it needs, mapping each one to an environment-variable name.
• At run time, MaxoPerf injects those variables into the runner before your test starts.
• The runtime payload is short-lived and scoped to a single run.

Create and bind a secret

1. Open the project that owns the test, switch to the Secrets tab, and click New secret. Give it a clear name, like checkout-api-token.
2. Paste the value — it’s encrypted as soon as you save.
3. Open the test’s Settings tab and add a secret binding: pick the project secret, then choose the environment-variable name the test expects.

Environment variable name must start with SECRET_

The bound variable name must match ^SECRET_[A-Za-z0-9_]{1,120}$ — for example, SECRET_CHECKOUT_API_TOKEN. Bindings that don’t match are rejected.

Read the variable normally in your test files:

• Taurus: ${__env(SECRET_CHECKOUT_API_TOKEN)}
• k6: __ENV.SECRET_CHECKOUT_API_TOKEN
• JMeter: ${__BeanShell(System.getenv("SECRET_CHECKOUT_API_TOKEN"))}

See Manage test secrets for the full secrets workflow, including rotation.

Running the same test across environments

The same pattern that keeps a token out of a test file also keeps environment-specific values (base URLs, tenant IDs, feature-flag keys) out of it:

• Bind an environment-specific value — a staging vs. production base URL, for example — the same way you bind a secret: as a named variable the test reads at run time, not a value hardcoded into the scenario.
• Keep one test definition per scenario and vary only the bound values per run, rather than maintaining near-duplicate test files per environment. This keeps the test itself — the actual request flow or user journey — in one place, so a change to the scenario doesn’t need to be copied across environment-specific copies.
• Use a naming convention across environments (checkout-api-token-staging, checkout-api-token-prod) so it’s obvious at a glance which secret backs which run, especially when an AI agent is choosing which one to bind.

For AI agents generating or running tests

When asked to run a test “against staging” or “against prod,” bind the environment-appropriate secret and variable rather than asking for or embedding a raw credential in the request. If no environment is specified, ask which one before running — a test aimed at the wrong environment can generate real load against production.

What never happens

• Secret values are never written to result pages, run logs, or downloaded artifact bundles.
• Secret values are never available to teammates without project-level access.
• Secret values are never logged by the runner — only the names of injected variables appear in diagnostic output.

Where to go next

• Manage test secrets — the full secrets UI walkthrough, including rotation.
• Get an API key — the MaxoPerf-account credential you keep out of test files the same way.
• Connect AI tools — instruct an agent to follow this pattern when it generates tests.