Tendrl

Docs / Strand / workflow-editor/workflow-variables

Workflow Variables

Workflow Variables let you store reusable key-value pairs accessible in all workflow steps.

Purpose

Store non-sensitive configuration values that are used across multiple nodes:

Security Guidelines

Workflow Variables are stored in plain text. Do NOT store sensitive data here.

Never store:

  • API tokens, passwords, secrets
  • Database credentials
  • OAuth tokens or refresh tokens
  • Private keys or certificates
  • Session tokens
  • Vault secret values (if copied/extracted)

Safe to store:

  • API base URLs
  • Timeout values
  • Feature flags
  • Environment names
  • Reusable constants

For sensitive values, use the Global Vault which encrypts values at rest.

Vault + Variables Interaction

Do not copy vault values into variables. While vault values are encrypted in storage, copying them to variables would store them in plain text and bypass security protections.

Wrong:

jinja

# Don't copy vault values to variables
# This would expose the secret in plain text

Right:

jinja

# Use vault directly in each request
"Authorization": "Bearer {{ vault.api_token }}"

Accessing Values

Use the variables variable in templates:

jinja

{{ variables.api_base_url }}
{{ variables.timeout | default(30) }}
{{ variables.env }}

Use Cases

API Base URL

Store the base URL for your API:

json

{
  "api_base_url": "https://api.example.com"
}

Then use in HTTP requests:

jinja

{{ variables.api_base_url }}/users/{{ payload.user_id }}

Timeout Values

json

{
  "timeout": 5000
}

Use in conditions or calculations.

Environment Configuration

json

{
  "env": "production",
  "debug": false
}

Use for conditional logic:

jinja

{{ 'prod' if variables.env == 'production' else 'dev' }}

Best Practices

  1. Store values that are used in multiple places
  2. Use descriptive keys
  3. Update values in one place (the Variables panel)
  4. Never store sensitive data (API tokens, passwords, secrets) - use the Global Vault instead
  5. Use connectors for service credentials (AWS keys, database passwords, etc.)

← Back to Strand docs