# ...
x-speakeasy-test-security: # Defined at the top level of the Arazzo file, all workflows will be configured to use the specified security credentials
  value:
    # The keys below MUST match the securitySchemes names from your OpenAPI document
    myApiKeyScheme: "x-env: TEST_API_KEY" # Values can be pulled from the environment
    myBasicAuthScheme:
      username: "test-user" # For schemes requiring multiple values, provide a map
      password: "x-env: TEST_PASSWORD"
    myBearerTokenScheme: "x-env: TEST_BEARER_TOKEN"
    myOAuth2Scheme:
      clientId: "x-env: MY_CLIENT_ID"
      clientSecret: "x-env: MY_CLIENT_SECRET"
      tokenURL: "http://test-server/oauth2/token" # Redirect OAuth flow to test server
workflows:
  - workflowId: some-test
    x-speakeasy-test-security: # Security can be defined/overridden for a specific workflow
      value:
        myApiKeyScheme: "test-key"
    # ...
    steps:
      - stepId: step1
        x-speakeasy-test-security: # Or security can be defined/overridden for a specific step
          value:
            myBearerTokenScheme: "x-env: TEST_AUTH_TOKEN"
        # ...
      - stepId: step2
        # ...
```

**Note:** For OAuth2 schemes, you can override the `tokenURL` to redirect the authentication flow to a test server instead of the production endpoint. This allows you to test OAuth2 flows against mock servers or staging environments without affecting production authentication systems.

### Using Runtime Expressions for Dynamic Security

The `x-speakeasy-test-security` extension also supports runtime expressions, allowing you to populate security credentials dynamically from the outputs of previous steps. This is particularly useful for workflows that require authentication tokens obtained from login operations.

For example, you can use a runtime expression to reference a token from a previous authentication step:

```yaml
arazzo: 1.0.0
info:
  title: Example
  summary: Example of a test suite
  version: 0.0.1
sourceDescriptions:
  - name: ./example.yaml
    url: https://example.com
    type: openapi
workflows:
  - workflowId: createUser
    x-speakeasy-test-security:
      value:
        apiKey: $steps.authenticate.outputs.token
    steps:
      - stepId: authenticate
        workflowId: authenticate
        requestBody:
          contentType: application/json
          payload:
            {
              "username": "trystan.crooks@example.com",
              "password": "x-env: TEST_PASSWORD",
            }
        successCriteria:
          - condition: $steps.authenticate.outputs.token != ""
        outputs:
          token: $steps.authenticate.outputs.token
      - stepId: create
        operationId: createUser
        requestBody:
          contentType: application/json
          payload:
            {
              "email": "Trystan_Crooks@hotmail.com",
              "first_name": "Trystan",
              "last_name": "Crooks",
              "age": 32,
              "postal_code": 94110,
              "metadata":
                {
                  "allergies": "none",
                  "color": "red",
                  "height": 182,
                  "weight": 77,
                  "is_smoking": true,
                },
            }
        successCriteria:
          - condition: $statusCode == 200
          - condition: $response.header.Content-Type == "application/json"
          - condition: $response.body#/email == Trystan_Crooks@hotmail.com
          - condition: $response.body#/postal_code == 94110
        outputs:
          id: $response.body#/id
      - stepId: get
        operationId: getUser
        parameters:
          - name: id
            in: path
            value: $steps.create.outputs.id
        successCriteria:
          - condition: $statusCode == 200
          - condition: $response.header.Content-Type == "application/json"
          - condition: $response.body#/email == Trystan_Crooks@hotmail.com
          - condition: $response.body#/first_name == Trystan
          - condition: $response.body#/last_name == Crooks
          - condition: $response.body#/age == 32
          - condition: $response.body#/postal_code == 94110
```

In this example:

- The workflow defines `x-speakeasy-test-security` at the workflow level with `apiKey: $steps.authenticate.outputs.token`
- The first step (`authenticate`) calls an authentication workflow and captures the token in its outputs
- All subsequent steps in the workflow will use this dynamically obtained token for authentication
- The runtime expression `$steps.authenticate.outputs.token` references the token output from the authenticate step

This approach enables complex authentication flows where tokens must be obtained dynamically during test execution, rather than being provided as static values or environment variables.

## Configuring environment variable provided values for Contract tests

When running tests against a real API, you may need to fill in certain input values from dynamic environment variables. Use the Speakeasy environment variable extension to do so:

```yaml
arazzo: 1.0.0