Projects, secrets and roles
This page shows how to set up a project, control who can do what, and keep credentials out of your scripts.
A project holds one application’s scripts, agents, secrets, members, jobs and suites.
Create a project
Section titled “Create a project”On the Projects page choose New project. The name is 3 to 50 letters, numbers, - or _. Pick where the scripts live:
- Local: the files stay on the server, in
projects/<user>/<project>/. - Git (GitHub, GitLab, OneDev or Azure DevOps): give the repository URL, an access token and a branch. A push webhook keeps the project current.
Then add an agent.
locators.yaml
Section titled “locators.yaml”Browser scripts read their element names from locators.yaml in the project root. Reflex creates an empty file when it is missing. How to write locators is in browser testing.
Members and roles
Section titled “Members and roles”Under Manage:
- Members: add people by their username. They need a Reflex account first. Then give each member a role and, if you want, groups.
- Groups: bundle members. Give a group to a job or suite, and everyone in it can see and run it.
- Roles: a role is a set of switches. Anything not switched on stays read-only. You can only switch on what you can do yourself. Role names cannot be renamed later.
The switches are:
| Area | Permissions |
|---|---|
| Jobs and scripts | Edit jobs, start jobs by hand, run scripts |
| Members and access | Manage groups, manage roles, assign roles, manage members, manage agents |
| Project | Project settings (including secrets), repository sync, use dev secrets, review heals |
Sign-in (local accounts, SSO) is set by the administrator: see configuration.
Secrets
Section titled “Secrets”Store tokens, passwords and keys as secrets, never in scripts. They are encrypted at rest, masked in run output and never shown again after you save them.
Open Manage, then Secrets, and choose Add secret. Enter a key such as API_TOKEN and its value. Read it in a script:
local token = secret("API_TOKEN")You need the Project settings permission to change secrets. Export downloads all secrets as a password-protected .jks keystore, and Import loads one.
For local runs with the CLI, a secret can have a separate development value. Switch on Use dev secrets for the roles that need it.
Project settings
Section titled “Project settings”Under Manage, Settings sets defaults for every job and suite in the project:
- Replay: off, on failure or always. Replays let you step through a run afterwards: see replays.
- Browser: how long a script waits for an element (milliseconds), the window size and headless mode.
- Results database: the CouchDB URL and login that scripts in this project can use.