Environments and secrets
Environments
Section titled “Environments”vars in the config are the defaults for every environment. To change them for one environment, put them in
.specbook/environments/<env>.env, or under environments.<env>.vars in the config. A service’s address is a
variable, so each environment can point somewhere else:
services: { petstore: { spec: './openapi/petstore.json', baseUrl: '{{petstoreUrl}}' } }petstoreUrl=https://staging.petstore.example/api/v3Secrets
Section titled “Secrets”Name your secrets in the config, for example secrets: { PETSTORE_API_KEY: {} }. Specbook reads each one from an
environment variable first, then from --secrets-file, the environment’s <env>.secrets.env and
secrets.local.env. The folder’s .gitignore keeps the secrets files out of your repository.
Run specbook secrets --env staging to see where each secret resolves from. It never prints a value. A test run
masks every secret value wherever it appears, including its URL-encoded, JSON-escaped and base64 forms, and removes
credentials from reports.
In a browser
Section titled “In a browser”A published portal never holds a secret. A visitor types credentials once per tab, they are kept per API origin, and a key typed for one API is never sent to another. An embed keeps them in memory only.
Addresses on the same origin
Section titled “Addresses on the same origin”A relative address such as /api/petstore resolves against the page, so one environment file serves every host a
site is published on. This site’s demo environment works that way.