# Variables & Secrets

Source: https://www.jawsdeploy.net/features/variables

Store variables and secrets once, then resolve the right values for each environment, target, and step during deployment.

Use scoped variables for connection strings, service settings, feature flags, and deployment-specific values without hard-coding them in CI. Scope each value as broadly as a workspace or as narrowly as a single step, and let steps hand computed values to each other through output variables.

- Scoped from workspace down to a single step
- Encrypted secret handling
- Nested variable references
- Output variables shared between steps

## Scope a value to exactly where it applies

Define a variable once and attach one or more values, each scoped to where it should apply. When several scopes match the same variable, the most specific value wins: step beats target, target beats tag, tag beats environment, environment beats project, project beats workspace.

- Workspace — shared defaults across every project
- Project — values owned by a single project
- Environment — Dev, Staging, and Production differ
- Target & tag — per-machine or per-role values
- Step — a value that applies to one deployment step

## Scope a value to a single Project Step

A variable value can carry a step filter, pinning it to one or more steps in the deployment process. A step-scoped value is the most specific scope there is — when that step runs, its value overrides the environment-, target-, or tag-scoped value for the same variable. Use it when one step needs a different connection string, path, or feature flag than the rest of the process, without inventing a new variable name.

## Output variables: pass values between steps

Steps don't only consume variables — they can produce them. A script step records an output value that later steps in the same deployment read back by reference. Use it to hand a generated URL, a resource ID, or a computed version number downstream, with no database or temp file in between. Values can be scoped to the machine that produced them or shared globally across the deployment.

```
# PowerShell — record an output value
Set-JawsOutputValue -Name "DeployedUrl" -Value $url

# Python — the same, shared across the whole deployment
import jaws
jaws.set_output_value("DeployedUrl", url, scope="Global")

# A later step reads it back by reference
#{OUTPUT.Step.Deploy Web App.Global.DeployedUrl}
```