Test logins and passwords

Most apps need a login. ReplayQA handles credentials so they never appear in videos, steps, screenshots or logs.

How passwords get into a test

You don't need to set anything up in advance. When a video shows someone typing a password, ReplayQA:

1. replaces the typed value with a placeholder such as {{secret:LOGIN_PASSWORD}},
2. asks you for the real value during validation, and
3. stores it encrypted for that site, then types it in at run time.

The value is never shown again after you save it, and it's masked in screenshots, videos, traces and logs.

Managing secrets

Go to Sites & test logins and open a site to see its secrets:

• Add a secret with a name (for example LOGIN_EMAIL or LOGIN_PASSWORD) and a value.
• Replace a value by saving the same name again, for example after you rotate a password.
• Use it in any step's value as {{secret:NAME}}.

Secrets belong to a site, so Staging and Production can use different accounts with the same test.

Signing in before every test

If most of your flows start on a signed-in page, record sign-in once and reuse it:

1. Record a short video of signing in and nothing else, and upload it.
2. Let it validate. You'll be asked for the password once.
3. Go to Sites & test logins, open the site, and under Sign in with choose that test. Press Save.

From then on, every test on that site replays the sign-in test first, so other videos can start already signed in. To turn it off, choose No sign-in (tests start signed out).

If you upload a video that starts on a signed-in page before this is set up, the run page explains what's needed and links straight to these settings.

Who can see and change secrets

Only Admins and Owners can manage a site's secrets. Others can use them in tests but can't read them. See Security and data.