Skip to main content
A test that types test@example.com into a sign-up form works once. Testorim substitutes {{token}} placeholders in a step’s target and value at run time so it works every time.

​
Built-in generators

Always available, nothing to configure.
Each token resolves once per run. The {{random.email}} typed during sign-up is the same address typed during sign-in later in the same run. That is what makes a round-trip test possible.

​
Project variables

Project settings → Variables defines your own tokens, used the same way: {{couponCode}}, {{accountNumber}}. A variable is either a fixed value or a generated one, such as a random integer within a range, for instance. Like the built-ins, each one resolves once per run and keeps that value for every step that references it. A procedure saved from a run keeps its {{tokens}}, so every replay gets fresh values. Variables can be changed later; the steps themselves cannot.
Do not store secrets as variables. Variables are stored as plain project configuration. See Variables and secrets for where a secret belongs.

​
Values you supply mid-run

Some values cannot exist before the run does: a one-time passcode, an SMS code, a CAPTCHA answer, a device-trust confirmation. Ask for it in the instruction and the run pauses, shows you a prompt, and continues with your answer:
Later steps reference the answer as {{prompt}} (the most recent) or {{prompt:fieldName}} when more than one was requested. The run waits up to 10 minutes. The answer is typed into a masked field.
This needs a person watching the run in the app. Do not use it in a test that runs unattended: a schedule, the API, the CLI, the PR bot or a fuzz batch has nobody to answer, and the step waits out its time before it fails. If the tab running the test is closed for good, a waiting prompt fails at once. For unattended sign-in, use a login-setup procedure.

​
Uploading files

Fixtures are files you attach to a project, in project settings → Fixtures, so an upload step has something real to send. Reference the fixture by name in the instruction: “upload the sample-invoice fixture to the attachment field”. A fixture can be up to 20 MB, and each project has a storage allowance set by the plan (see Plans and limits).

​
Redaction

Values typed into fields whose name suggests a secret (password, secret, token, PIN, OTP, CVV, SSN) are stripped before the run is persisted, before the report model sees them, and before a shared link renders. That covers the typed value, the value read back for verification, both sides of an assertion, and any error or warning text that quoted it. Identifier-shaped names are covered too: userPassword, pwdField and secretKey redact, not just a bare Password. A value a check reads back from a password field, or from under a password-like label, is stored as ***. Saving a run as a procedure is the one place a typed password is kept, and it is kept encrypted so the replay can type it. See Passwords in a procedure.