Test accounts and secrets
Give Re:agent an account to sign in with, without the password reaching the chat or the test.
Re:agent signs in to your app with a test account, the way a person would. Signing in becomes part of the flow, and the test signs in the same way on every run.
Use an account made for testing. A test account belongs to a project and works on the addresses you pick for it.
Kinds of account Link to Kinds of account
| How it signs in | What you give | Use it for |
|---|---|---|
| With a password | An email, username or phone number, and its password. | Apps with a sign-in form. |
| With an email code or link | A name. Rehearsal makes the account's address. | Apps that send a code or a link to sign in. |
Only a person can add a password account. Re:agent can add one that signs in with an email code or link.
Tests that sign up need no account. Each run signs up with a new address and a password Rehearsal keeps.
There is no option to sign in with Google, Microsoft or GitHub.
Add an account Link to Add an account
Step 1: Open Test accounts
In Re:agent, choose the project in the menu at the top. Under Re:agent uses, choose Test accounts.
Step 2: Choose how it signs in
Press Add account. Under How does this account sign in?, pick With a password or With an email code or link.
Step 3: Fill in the details
- Name is what you call the account, such as
admin. It must be unique in the workspace. - For a password account, fill in Email, username or phone number and Password.
- If your app asks for a code after the password, check This account also needs a code after the password. Pick From an authenticator app and paste its secret key. Or pick Sent by email, and the account gets its own address for the code.
- Where it works appears when the project has more than one address. Pick every one it can sign in to. An address you add later is not covered.
- Name is what you call the account, such as
Step 4: Save it
Press Add account. Adding an account needs the Manage projects permission.
An account that signs in with an email code or link gets its own address, such as acme-admin@inbox.rehearsal.dev. Create the account in your app with that address once.
How Re:agent picks one Link to How Re:agent picks one
Re:agent reads the project's accounts and picks one for each browser. Each browser signs in with one account at most.
When Re:agent is not sure, it asks which account to use. You can pick one, or add one from the question. See Questions from Re:agent.
Each account in the list shows when it was last used and how that session ended.
How secrets stay out Link to How secrets stay out
- The password and the secret key are saved encrypted. Re:agent never sees them.
- Re:agent types a placeholder, and Rehearsal puts the real password into the field.
- The saved step reads
{{password}}. The written test callspassword(), which gives the real value only while the test runs. - A code from an authenticator app is saved as
{{authenticator}}. The test callsauthenticatorCode()for the current code. - A password field takes only the test account's password, never one written in the chat.
- Codes and links from the test inbox are saved as
{{code}}and{{link}}. See The test inbox. - Rehearsal takes these values out of the steps it saves, the record of Re:agent's work and run results.
- Re:agent does not ask for a password or a code in a question.
Keep passwords out of the chat. A message stays in the chat as you typed it, so add the password to a test account instead.
Remove an account Link to Remove an account
Press the remove button on the account. Re:agent can no longer sign in with it.
A test that signs in with a removed account can no longer run. Its results say Blocked.
Next steps Link to Next steps
- Read how the test inbox handles codes and links.
- Test flows with more than one person, each with their own account.