Recipe template variables
The full list of {variables} you can use in recipe commands, where they resolve from, and how to reference secrets safely.
Last updated 2026-07-07
Recipe step commands are templates. At run time AppRelay substitutes {variables} with values from the lane, the project, and your secrets. This is how a single recipe — say one playConsole.upload-track — serves every Android lane you have. This article lists the variables you can use.
How substitution works
Write a variable in curly braces inside a command:
{gradlew} :app:bundleRelease
xcrun altool --upload-app -f {exportPath} --apiKey {secret.ascKey}Before the step runs, each {name} is replaced with its resolved value for the current lane and project. Unresolved or misspelled variables are surfaced rather than run blindly, so a typo doesn't silently become an empty string.
Path & project variables
| Variable | Resolves to |
|---|---|
{root} | The project's repo root on this machine |
{workdir} | The lane's working directory (relative to the root) |
{bundleId} | The lane's bundle / application id |
{versionName} | The current marketing/version string |
{versionCode} | The current build number |
Toolchain variables
| Variable | Resolves to |
|---|---|
{scheme} | The Xcode scheme |
{gradlew} | The project's Gradle wrapper |
{sdk} | The target SDK |
{jdk17} | A resolved JDK (e.g. for Android builds) |
Distribution variables
| Variable | Resolves to |
|---|---|
{track} | The Play Console track (internal/closed/open/production) |
{bucket} | The S3 bucket |
Distribution channels expose their own parameters as variables too — for example a Docker image and tag, a GitHub repo and tag pattern, or an rsync host and remote path. Whatever a channel declares as a parameter is available to its recipe by name.
Secrets
Reference a secret with the secret. prefix:
--apiKey {secret.ascKey}
--token {secret.firebaseToken}{secret.<ref>} value is pulled from the encrypted store at run time, so it stays out of your recipe text, out of exports, and out of the visible log. See Secrets & encryption.Delivering a secret through the environment
A {secret.<ref>} substituted into a command is safe from injection, but the value still lands in the process's argument list — visible to ps on a shared machine. To keep a secret out of the command line entirely, give a step an environment variable: in the step editor, add a row like API_KEY = {secret.ascKey}, then reference it in the command as $API_KEY. AppRelay injects the resolved value into that step's environment, so it reaches the tool but never appears in argv or a process listing.
# env: API_KEY = {secret.ascKey}
curl -H "Authorization: Bearer $API_KEY" https://api.example.com/deployWhen a variable doesn't exist
If your command needs something the built-in variables don't cover, two escape hatches apply: add the value as a channel/toolchain parameter (which then becomes a variable), or move the whole thing into a customShell step that calls a script in your repo where you can compute it. Keep step commands declarative; put logic in scripts. See Recipes.