# Configuration overview

Choose the right configuration resource and understand how Environments, Variables, Secrets, Credentials and OAuth apps fit together.

Last updated: 2026-10-18

Configuration supplies the values and account access your Workflows need. A Workflow refers to a
value by name; the Environment it runs in determines which value it uses.

## Choose what you need

| You need to… | Use |
| --- | --- |
| Keep test and production configuration separate | An [Environment](/configuration/environments) |
| Store a readable value, such as a destination URL | A [Variable](/configuration/variables) |
| Supply a hidden value, such as an API key | A [Secret](/configuration/secrets) |
| Authorize an account on another service and maintain its access token | A [Credential](/configuration/credentials) |
| Supply the app registration used for that authorization | An [OAuth app](/configuration/oauth-apps) |

## Names in the Workspace, values in Environments

Variable and Secret names belong to your Workspace. Each name has one kind throughout the
Workspace: Variable or Secret. Its value belongs to an Environment.

For example, a Workflow can use `vars.API_URL` and `secrets.API_TOKEN`. In staging, those names
identify the staging service and its token. In production, the same names identify the production
service and its token. Set the values separately in each Environment.

These values are shared configuration for Workflows running in that Environment. They are not
private settings attached to an individual Workflow. Changing a shared value can affect several
Workflows. The [Variables](/configuration/variables#when-a-change-takes-effect) and
[Secrets](/configuration/secrets#changing-a-secret) Articles explain when changes take effect.

## A Credential maintains a Secret

You can enter a Secret directly, such as an API key issued by a service. For a service that uses
OAuth account authorization, a Credential maintains the matching Secret instead. Your Workflow
uses `secrets.NAME` in either case.

The OAuth app is the registration used to request authorization. The Credential is the resulting
authorized account link, and it belongs to one Environment. A custom OAuth app belongs to the
Workspace and can be used for more than one Credential.

## Sensitive setup stays in Typenode

Your Agent can prepare a sensitive setup request. You then enter the value or authorize the account
through the Typenode page it opens. The Agent checks the result after you finish. Preparing a
request alone does not mean setup is complete.

Read [Sensitive data and handoffs](/agents/sensitive-data) to understand what the Agent
receives, how sensitive values are protected, and how Workflows use them.