Skip to main content
An environment is a named address for a project, with the HTTP headers its runs should send there. The point is that one saved test covers every deployment you have. You do not keep a staging copy of a production test.

​
Creating one

Project settings → Environments → Add environment. Only a workspace owner or admin can add an environment or change its address, because a saved procedure’s password may be typed on any of the project’s environments.

​
The default environment

When a project has a default environment, every run that names no environment uses it: chat runs, procedure replays, schedules and API triggers. Its address replaces the project’s own, and its headers are sent. There is no “no environment” choice while a default is set. To run against the project’s own address without it, unset the default. A run that overrides the base address (a PR preview, a --base-url, a schedule’s own address) does not get the default environment, so its headers never reach a host they were not saved for.

​
Using one

The CLI does not pick an environment. It uses the default, or a --base-url for a one-off address:
Changing the environment in the app starts a fresh browser session. It never happens in the middle of a run.

​
Headers

Headers are the right place for an API token, a preview-deployment bypass header, or a feature flag.
  • Sent to the environment’s own address only: the same scheme, host and port. Other sites the page loads (analytics, CDNs, an API on a sibling host) never receive them. If that address redirects a request elsewhere, the headers go with the redirect.
  • Not sent on WebSocket connections or on requests a service worker answers.
  • Stored encrypted and never shown again. The app and the API show each header’s name with *** for its value. When you edit an environment, leave a value empty to keep the saved one.
  • Removed from each run’s trace before it is saved. A page that displays a header value will still show it in the recording and screenshots.
Some headers are never sent: Authorization, Proxy-Authorization, Cookie, Host, Forwarded, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, X-Real-IP, X-Original-User, X-Original-URI, and cloud metadata headers. They either let a request escape the address the project is pinned to, or forge an identity the browser should be establishing itself.For an authenticated session, use a login-setup procedure.

​
Cookies

An environment can also carry cookies, up to 50. Add them when you create the environment, or with Cookies on an existing one, which replaces or removes the saved set. They are encrypted at rest and applied to the browser before the run starts, and each one is set for the environment’s own address.

​
A typical setup

production

The project’s own address. Scheduled nightly. Alerts to Slack.

staging

Staging address plus a bypass header. Run on demand.

preview

Address built per pull request by the GitHub integration from its preview pattern.