...

Furthermore, the Edit Check settings page will look like this:

...

Step 1: Add Existing Credentials to a Postman Environment

Postman environments allow for the storage of secrets/keys so that they can be re-used/hidden in Postman. By moving your credentials to the Postman environment, you are allowing them to be exported into a format which the Postman check runner will able to read. Here is an example of an Environment we set up in Postman which will store our GitHub credentials:

...

You will reference the “variable” in your script as an environment variable. For example, this script uses {{apiKey}} since the variable is apiKey.

Step 2: Export Postman environment to file

...

Click the Meatballs Menu (three dots positioned horizontally) and select “Export”. Export using the latest JSON schema version.

Step 3: Edit your original Postman collection to substitute secrets for environment variables

Open your Postman collection file. It will look similar to this:

...

Replace your secrets (e.g. Username and Password) with the environment variables you defined in your Postman collection in the previous step. See {{username}} and {password}} substitutions in the above screenshot.

Step 4: Encrypt your Postman environment file

First, install Cryptify onto the private agent which is running your Postman checks using NPM:

...

Of course it is mandatory to replace “file.txt” with your file name and Secret123 with your password. Now, try to open up the Postman environment file. It should look garbled and unreadable. That means the encryption worked.

Step 4: Upload your files to GitHub and add fields

The environment file (uploaded from Postman) and the Postman file should be stored in the same directory. In our example, we stored our Postman collection in /postman relative to my Repository Root which we defined in our Repository Profile:

...

The value of “Decrypt Key” should be the password that you used to encrypt your file with Cryptify. The password essentially works as an encryption/decryption key within Cryptify - and since the Postman check runner uses Cryptify, it will know how to decrypt the environment file using your password (the “decrypt key”).

Step 5: Test the check

Run the check in ASM and ensure that all credentials are hidden as expected. If the check fails, submit any error logs to Support with a brief explanation of the issue.