Variables
Workflow-level constants — and sensitive variables that are encrypted, write-only, and masked everywhere GoRunner writes data down.
Variables are workflow-level values addressed as {{$vars.NAME}} — base URLs, thresholds, sender addresses. Edit them in the workflow's Variables panel. They come in two kinds, and the difference is the whole point:
| Plain | Sensitive | |
|---|---|---|
| Lives in | The definition — ships on publish, appears in exports, snapshots and diffs | Encrypted storage outside the definition — can never leak through exports, snapshots, templates or duplicate |
| Reading it back | Normal config value | Write-only: reads return the name, never the value (updates pass keep: true for a value the client was never given) |
| In run records | Recorded as resolved | Masked as *** by value — "key was " + token masks too, whatever the field is called |
| Changes take effect | At the next publish, like any definition edit | Immediately on save — you must be able to rotate a leaked key on a live workflow now |
| Use it for | Base URLs, thresholds, copy | Ad-hoc secrets — an API key in an HTTP header, a signing secret a Code step reads |
Names must be resolver-safe (letters, digits, underscore — the panel validates against how the resolver actually behaves). Promoting a plain variable to sensitive also scrubs it by name from existing version snapshots.
Very short values are refused
Masking a 4-character value would blank unrelated text across every run record, so GoRunner refuses to mark it sensitive rather than promise protection it can't apply.
Variables vs. connections: use a connection when a piece has a first-class auth model (testing, usage tracking, one-click rotation); use a sensitive variable for everything ad-hoc.