Skip to content

Environment Files

Keep secrets in .env, out of your YAML.

curl-runner loads .env and .env.local, plus .env.<name> and .env.<name>.local when you pass --env <name>. Values become variables, and anything named SECRET_* is redacted from output.

Read the docsInstall curl-runner
api.yaml
# .env.staging
#   API_URL=https://staging.example.com
#   SECRET_API_KEY=...
#
# curl-runner api.yaml --env staging
request:
  name: List users
  url: ${API_URL}/users
  headers:
    X-API-Key: ${SECRET_API_KEY}
  expect:
    status: 200

Benefits

  • One file per environment

    --env staging layers .env.staging over .env; .local files override both and stay out of git.

  • Redacted by default

    SECRET_* values, and common token formats, show as [REDACTED] in the terminal and in saved results.

  • The same YAML everywhere

    Point one suite at local, staging and production by switching the --env name.

Good for

  1. API keys and tokens that must not be committed
  2. Switching between staging and production
  3. Per-developer overrides in .env.local
  4. CI logs that must not leak credentials