> ## Documentation Index
> Fetch the complete documentation index at: https://www.minitap.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets and test files

> Store the passwords, codes and cards Mini types without seeing them, and the photos and documents your scenarios upload.

Two pages under **Builds & test data** hold what a scenario needs beyond its steps. **Secrets** keeps the values Mini types but never sees, like a password, an OTP seed or a test card. **Files** keeps the photos, documents and videos Mini uploads in your app. This page covers both, in the dashboard and from the CLI.

## Secrets

```text theme={"theme":{"light":"github-light","dark":"vesper"}}
Sign in as the admin with {{secret:ADMIN_PASSWORD}}, add one item to the cart
and pay with {{secret:STAGING_CARD.number}}.
```

You write a reference, Mini sees only the name, and the device gets the value. Values typed on screen are blacked out in the screenshots Mini reads, so Mini works with the name from start to finish.

![Builds & test data, Secrets: a test card secret and two password secrets, each with what uses it, when it was last used and its version](https://mintcdn.com/minitap-30239763/QCLbAMcddko_3eZy/minitest/images/app/secrets.png?fit=max\&auto=format\&n=QCLbAMcddko_3eZy\&q=85\&s=379ba9e4d5185d007f74714997d269a2)

Secrets list what uses them and when they were last used.

### Kinds of secret

| Kind | What it holds |
| - | - |
| **Password** | A password Mini types without ever reading it. |
| **OTP seed** | A base32 seed or an `otpauth://` URL. Mini gets the live 6-digit code at the moment it needs it. |
| **Card** | A test card: number, expiry, CVC, and optionally the name on card and postal code. |
| **API token** | An API key or token for setup commands and API calls, like the ones a [skill](https://www.minitap.ai/docs/minitest/setup/skills.md) makes. |
| **Text** | Any other value: a fixed OTP code, a PIN, a recovery phrase. |

A code that never changes is a **Text** secret. Use **OTP seed** only when your app generates codes from a seed, like an authenticator app does.

### Create a secret

**1. Open Secrets**

In your app, go to **Builds & test data → Secrets** and click **New secret**.

**2. Name it**

The **Name** is how scenarios, skills and Mini refer to the secret. Upper case letters, digits and underscores, starting with a letter, up to 64 characters: `ADMIN_PASSWORD`, `STAGING_CARD`.

**3. Pick the kind and paste the value**

Choose the **Kind**, then paste the **Value**. It's stored encrypted.

**4. Say what it is for**

Fill **What it is for**, like `Back-office admin sign-in`. Mini reads this note, never the value, so it knows when to use the secret. Click **Save secret**.

### Reference a secret

In a scenario's description, its acceptance criteria or a skill's instructions, write `{{secret:NAME}}`. Typing `{{` opens **Insert a secret** with the app's secrets, and you can create a new one from the same list. For a card, reference one field: `{{secret:STAGING_CARD.number}}`, `.expiry`, `.cvc`, `.holder_name` or `.postal_code`.

The editor checks your text as you write:

* **A value that should be a secret.** If you paste a saved secret's value, or something that looks like a password or a key, the editor offers **Use NAME** or **Move to Secrets**.
* **A name with no secret.** A reference to a secret that doesn't exist offers **Create NAME**. Until it exists, a run stops that scenario as blocked.
* **The old syntax.** `$NAME` still works in scenarios, and the editor suggests `{{secret:NAME}}` instead.

### Use a secret on a test account

A test account's **Password**, **OTP** and **Test card** fields can point to a secret instead of holding the value. Pick the secret in the field, or **New secret…** to create it there. The **Password** field takes a **Password** secret, **OTP** an **OTP seed** or a **Text** secret with a fixed code, and **Test card** a **Card** secret. The rest of the account setup is on [Test accounts and sign-in](https://www.minitap.ai/docs/minitest/setup/test-accounts.md).

### When Mini asks for a secret

Some values only you have: your real staging account, a card, a backend token. When Mini needs one while it writes or runs a scenario, it creates the secret without a value, says what it's for and which scenario needs it. The secret shows **Waiting for a value** and a **Set value** button.

A scenario that needs a secret without a value is held in the run, under **Waiting for a secret**, with a link to the secret. Set the value, then rerun the scenario.

### Manage a secret

Click a secret to open it.

* **Used by** lists the test accounts, scenarios and skills that reference it.
* **Activity** records every change: created, value replaced, renamed, used in a run, revealed or copied, and any leak of its value that was blocked.
* **Replace value** keeps the name and every reference, and stores a new version.
* **Rename…** rewrites the reference everywhere it's used: scenarios, criteria, skills and test accounts. Runs already started keep the old name.
* **Delete** works once nothing uses the secret. Remove its references first.

For an **OTP seed**, the secret also shows the **Current code** and how many seconds it has left, which helps when you sign in to the account yourself.

### Secrets from the CLI

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
minitest --json --app <app_id> secret list
minitest --json --app <app_id> secret describe ADMIN_PASSWORD
minitest --app <app_id> secret lint --scenario <scenario_id>
```

Create a secret without ever holding its value. `--generate` makes a random one, for an account Mini signs up with itself. `--empty` creates a secret that waits for your value:

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
minitest --json --app <app_id> secret create SIGNUP_PASSWORD --kind password --generate \
  --note "Password of signup@qa.minitap.ai"

minitest --json --app <app_id> secret create STAGING_CARD --kind card --empty \
  --reason "Checkout needs the card the staging payment provider accepts"
```

`secret set` creates or replaces a value and reads it from stdin only, so it never lands in your shell history:

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
printf '%s' "$STAGING_PASSWORD" | minitest --app <app_id> secret set STAGING_PASSWORD --kind password
```

`secret rename OLD NEW` rewrites every reference, `secret unset NAME` deletes a secret nothing uses, and `test-profile update <id> --password-secret NAME` links a secret to a test account. See the [CLI reference](https://www.minitap.ai/docs/minitest/reference/cli-commands.md) for every flag.

## Test files

Some journeys need a file on the device: an ID photo for an identity check, a PDF statement to upload, an avatar for the profile. Upload these once in **Builds & test data → Files**, then attach them to the scenarios that use them.

![Builds & test data, Files: the empty state with example files (an ID card image, a bank statement PDF, a profile video) and Upload files](https://mintcdn.com/minitap-30239763/QCLbAMcddko_3eZy/minitest/images/app/files.png?fit=max\&auto=format\&n=QCLbAMcddko_3eZy\&q=85\&s=19e6a9cd31333471d4a792a6b9d5daeb)

Builds & test data → Files, before the first upload.

### Upload files

Click **Add files**, or drop files on the page. Before the upload, check each file's details:

| Field | What it's for |
| - | - |
| **Display name** | How the file appears in pickers. Names are unique within the app. |
| **Note** | What the file is for, like `Passport photo for the identity check`. It helps Mini understand when and how to use the file. |

Each file can be up to 25 MB. Minitap sorts files into images, documents, videos, audio and other from their type.

### Attach files to a scenario

Open the scenario, go to its **Setup** tab and click **+ Add file** under **Files**. Pick files from the list, or **Upload new file** from there. Mini places attached files on the device before the run starts, and a file no scenario uses never reaches a device. How Mini picks a file up during the journey is on [What a scenario is](https://www.minitap.ai/docs/minitest/suite/anatomy.md#test-files).

For web apps, **Camera** in the same tab loops an image or a video into the browser's camera, for journeys that scan a QR code or a document. A camera video can be up to 50 MB.

### Manage files

The **Used by** column shows how many scenarios use each file. From a file's menu, **Edit** changes its name or note, **Download** gets the file back, and **Delete** removes it. A file still attached to a scenario can't be deleted: detach it everywhere first.

### Files from the CLI

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
minitest --json --app <app_id> test-file list --kind image
minitest --json --app <app_id> test-file upload ./fixtures/passport.jpg --note "ID photo for the identity check"

minitest --json --app <app_id> scenario-binding set-files <scenario_id> --file <file_id> --file <file_id>
minitest --json --app <app_id> scenario-binding list-files <scenario_id>
```

`set-files` replaces the scenario's whole set of files: pass every file it should keep. List the files first, since someone on your team may already have uploaded the one you need. For the camera of a web scenario, use `scenario update <scenario_id> --camera-media <path-or-file-id>`.

## Next steps

> [card] [Test accounts and sign-in](https://www.minitap.ai/docs/minitest/setup/test-accounts.md)
>
> The accounts Mini signs in with, and how their fields point to secrets.

> [card] [Skills](https://www.minitap.ai/docs/minitest/setup/skills.md)
>
> Procedures that set up test state, with the tokens they need.

> [card] [What a scenario is](https://www.minitap.ai/docs/minitest/suite/anatomy.md)
>
> Criteria, tags, files and accounts on one scenario.

> [card] [CLI commands](https://www.minitap.ai/docs/minitest/reference/cli-commands.md)
>
> Every `secret`, `test-file` and binding command.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.