Test logins and passwords

Most apps need a login. ReplayQA handles credentials so they never appear in videos, steps, screenshots or logs.

How passwords get into a test

You don't need to set anything up in advance. When a video shows someone typing a password, ReplayQA:

1. replaces the typed value with a placeholder such as {{secret:LOGIN_PASSWORD}},
2. asks you for the real value during validation, and
3. stores it encrypted for that site, then types it in at run time.

The value is never shown again after you save it, and it's masked in screenshots, videos, traces and logs.

Managing secrets

Go to Sites & test logins, open a site and choose Test logins. You can add them three ways:

• Email + password saves a sign-in pair in one go. Leave Account name empty to save EMAIL and PASSWORD, or enter one such as ADMIN to save ADMIN_EMAIL and ADMIN_PASSWORD.
• One value saves a single name and value, such as API_TOKEN.
• Paste many saves a list of NAME=value lines at once. A .env file works. If any line is wrong, nothing is saved.

Then:

• Replace value on a login's row to change it, for example after you rotate a password.
• Filter the list, or tick several logins and press Delete selected.
• Use a login in any step's value as {{secret:NAME}}. The copy button next to each one copies the reference.

To find a login when you have many sites, open Sites & test logins and switch to the Test logins view. It lists every login on every site, with search.

Secrets belong to a site, so Staging and Production can use different accounts with the same test.

Signing in before every test

If most of your flows start on a signed-in page, record sign-in once and reuse it:

1. Record a short video of signing in and nothing else, and upload it.
2. Let it validate. You'll be asked for the password once.

When it passes, it becomes the site's sign-in test automatically if the site doesn't have one yet. From then on, every test on that site replays it first, so other videos can start already signed in.

To choose a different sign-in test, or turn it off, go to Sites & test logins, open the site and choose Sign-in. Under Sign in with, choose a test, or No sign-in (tests start signed out), and press Save sign-in.

If you uploaded a video that starts on a signed-in page before you had a sign-in test, its validation stops at the sign-in page and the run page explains what's needed. You don't need to upload it again: once your sign-in video passes, that video is validated again automatically, signed in this time.

When you upload a video, Sign in as on the upload page shows which sign-in the new test will use. See Videos that start signed in.

Testing more than one role

When some flows need a different account, such as an admin, give each role its own sign-in test:

1. Save the role's login on the site with its own name, for example Email + password with account name ADMIN. This saves ADMIN_EMAIL and ADMIN_PASSWORD.
2. Record a short video of signing in as that account and upload it. Validate it, entering the admin's password when asked.
3. When you upload a video that needs that role, choose that sign-in test under Sign in as on the upload page. The new test signs in as that account from its very first run, so you don't need to record signing in again. For a test you already have, open it, and under Sign in as, choose Replay with that sign-in test and press Save.

Each test can choose:

• The site's sign-in, the default, set under Sign-in on the site.
• Another sign-in test, to run as that account on every site. Each site uses its own saved logins, so Staging and Production can have different admin accounts.
• No sign-in, to start signed out. Use this for the sign-up page or a public page.

Suites can mix roles. Every test starts in a fresh browser and runs its own sign-in first.

If one flow needs two roles, for example a user submits something and an admin approves it, either:

• split it into two tests and set their order in a folder or suite, which works when the first test's changes are saved on your site, or
• record the whole flow in one video, including signing out and signing in as the second account. A test that types a password itself doesn't replay a sign-in first.

Who can see and change secrets

Only Admins and Owners can manage a site's secrets. Others can use them in tests but can't read them. See Security and data.