Secrets
A saved request or a collection variable never holds a credential. Credentials go in Try it's Environment, which stays in the reader's browser. Before every save, update, variable change and import, the server checks the values, whatever the browser already checked, and refuses one that looks like a credential.
What's refused
| Where | Refused when |
|---|---|
| A header or query parameter | Its name is an apiKey parameter of a security scheme in your document. |
| A header or query parameter | Its name is authorization, proxy-authorization, cookie or set-cookie, or contains token, secret, password, api-key, apikey or api_key, and it has a value. |
| A collection variable | Its name is one of those, and it has a value. |
| Any value: a parameter, the body, the server, a server variable or a collection variable | It has the shape of a known secret, below. |
The shapes:
| Looks like | For example |
|---|---|
| A Stripe secret or restricted key | sk_live_…, rk_test_… |
| A GitHub token | ghp_…, gho_…, github_pat_… |
| A Slack token | xoxb-… |
| An AWS access key | AKIA… |
| A private key | -----BEGIN |
| One of our project or MCP keys | l10p_…, l10m_… |
| A JSON Web Token | eyJ….eyJ…. |
| A bearer or basic credential | Bearer or Basic followed by a token |
| A user or password in a URL | https://user@… |
A plain random-looking string passes, because IDs look like that too.
The answer
A refused save answers 422 with the reason and the field:
{ "error": "X-Api-Key is the API key of the ApiKeyAuth scheme. Credentials are never saved: enter it in Environment, where it stays in your browser.", "field": "header:X-Api-Key" }Every reason ends “Credentials are never saved: enter it in Environment, where it stays in your browser.” The reason names the field and the rule, never the value.
Where this comes from
app/reference/_lib/collections/secrets.tsapp/reference/_lib/collections/respond.tsapp/reference/_lib/collections/store.tstests/collections-parity.test.ts