Environments & secrets

Environments let you parameterize requests so the same collection works against local, staging, and production — and keep sensitive values encrypted.

Workspace-scoped variables

An environment is a named set of variables scoped to your workspace. Reference any variable with double-brace syntax, and API Stash substitutes the active environment's value at send time:

GET {{BASE_URL}}/users/{{USER_ID}}
Authorization: Bearer {{API_TOKEN}}

You can use {{VAR}} substitution in URLs, headers, and bodies.

Switching the active environment

Pick the active environment from the environment selector. Switching it changes every {{VAR}} value across your requests at once — so moving from staging to production is a single click, not a find-and-replace.

Secret values

Mark any value as a secret to hide it in the UI and protect it at rest. Secret values are encrypted at rest with per-workspace keys, so a secret stored in one workspace is never readable from another.

Secret variables

Any variable can be marked secret. Once set, its value is encrypted at rest and never shown again in the UI — you can replace it, but you can't read it back. You manage secrets in the Environments modal, right alongside your plain variables.

Secret values have a scope:

• Shared — one value for the whole workspace, used by everyone.
• Personal — a private, per-user override. At run time your personal value wins over the shared value, but only for you; teammates keep using the shared value (or their own personal override).

Reference a secret with {{NAME}} exactly like any other variable — API Stash substitutes the resolved value at send time, applying your personal override when one exists.

Personal vs shared environments

Environments come in two scopes:

• Shared — visible to everyone in the workspace; ideal for team-wide base URLs and common config.
• Personal — visible only to you; ideal for your own credentials or local overrides that shouldn't affect teammates.