Environments & secrets

Environment variables, secrets files, and how to reference them in flows

Each environment is a named config used when you validate or run a flow (--env local, or the desktop env selector).

Files

Under environments/ (or environmentsDir from quester.json):

Add *.secrets.json to .gitignore.

Environment (<name>.json)

Example

{
  "name": "local",
  "version": "v1",
  "variables": {
    "API_BASE": "https://dummyjson.com",
    "DEMO_PRODUCT_ID": "1",
    "TIMEOUT_MS": 5000,
    "DEBUG": true
  }
}

Reference in flows

{{env.API_BASE}}
{{env.TIMEOUT_MS}}

Secrets (<name>.secrets.json)

Example template (committed)

{
  "version": "v1",
  "secrets": {
    "API_TOKEN": "replace-me",
    "username": "emilys",
    "password": "emilyspass"
  }
}

Local file (gitignored)

cp environments/local.secrets.json.example environments/local.secrets.json

{
  "version": "v1",
  "secrets": {
    "API_TOKEN": "real-token-value",
    "REFRESH_TOKEN": "real-refresh-token",
    "username": "emilys",
    "password": "emilyspass"
  }
}

Reference in flows

{{secrets.API_TOKEN}}

{
  "headers": {
    "Authorization": "Bearer {{secrets.API_TOKEN}}"
  }
}

Staging vs local

environments/
  local.json
  local.secrets.json
  staging.json
  staging.secrets.json

bunx quester run flows/login.flow.json --workspace . --env staging --input '{"username":"demo"}'

Security notes

• Quester does not encrypt secrets at rest. Protect the workspace with OS permissions.
• Never commit *.secrets.json, .env, or live tokens.
• Resolved HTTP URLs must be http: or https: only.

Full trust model: SECURITY.md.

JSON Schema

Emitted schemas live under schemas/quester/. After changing @quester-studio/schema:

bun run --filter @quester-studio/schema build