Variable Syntax

Variables use the {{variableName}} syntax and can appear anywhere in a request — URL, headers, or body.

Resolution order

Variables resolve in this priority (highest wins):

1. Extracted flow variables (# @extract) — set during the current run
2. .env.local overrides — written by # @persist
3. Active .env file variables
4. File-level variables (@key = value)

Defining variables

File-level variables

Defined before the first ### with @key = value:

@baseUrl     = https://api.example.com
@contentType = application/json
@version     = v2

GET {{baseUrl}}/{{version}}/users
Content-Type: {{contentType}}

File-level variables can themselves reference .env variables:

@baseUrl = {{BASE_URL}}
@timeout = {{TIMEOUT}}

Environment variables

In dev.env:

BASE_URL  = https://dev-api.example.com
API_TOKEN = dev_abc123
TIMEOUT   = 5000

Used in requests:

GET {{BASE_URL}}/users
Authorization: Bearer {{API_TOKEN}}

Extracted variables (flow only)

# @extract pulls values from a response and makes them available as variables in subsequent steps:

### Login
POST {{baseUrl}}/auth/login
Content-Type: application/json

{ "email": "user@example.com", "password": "..." }

# @extract token  = $.access_token
# @extract userId = $.user.id

### Use token in next request
GET {{baseUrl}}/users/{{userId}}
Authorization: Bearer {{token}}

Variable autocomplete

The editor shows suggestions for all in-scope variables when you type {{. Press Tab to accept. Sources shown in autocomplete:

• File-level variables
• Active .env file variables
• Variables extracted in earlier steps (.flow files)

Using variables in URLs

@baseUrl = https://api.example.com
@userId  = 42

GET {{baseUrl}}/users/{{userId}}/posts?page=1

Using variables in headers

GET {{baseUrl}}/me
Authorization: Bearer {{API_TOKEN}}
X-Request-Id: {{requestId}}
Accept-Language: {{locale}}

Using variables in bodies

POST {{baseUrl}}/users
Content-Type: application/json

{
  "name": "{{userName}}",
  "email": "{{userEmail}}",
  "orgId": {{orgId}}
}

Note: number variables (like {{orgId}}) are injected without quotes so the JSON remains valid.

Mock Server built-ins

Inside a .mock response body, these built-ins resolve against the incoming request:

Variable	Description
{{path.0}}, {{path.1}}, …	Segments of the matched path
{{param.<name>}}	Named path parameter (/users/:id → {{param.id}})
{{query.<name>}}	Query-string value
{{body.<json-path>}}	Value from the incoming JSON body
{{header.<name>}}	Incoming request header
{{uuid}}	A fresh UUID v4 per response
{{now}}	Current ISO-8601 timestamp
{{response-var-<name>}}	A named @template variable defined in the route

See the .mock reference for full context.

Sensitive variables

Put secrets in <name>.env.local (auto-gitignored). A variable is treated as sensitive — masked in the env tooltip and value-redacted from request history — if its name contains token/secret/key/password/auth, or if it exists only in .env.local (file split = intent signal). Toggle Screencast mode (⌘⇧H) to also disable Copy buttons during demos. No directive to learn. See the .env reference.