Variables and secrets

A flow is meant to be reused. That is why it never stores a password or a home coordinate directly: it stores a token, and each client supplies its own value.

Write {{password}} in a flow, save password on twenty clients, and the same flow logs each of them in with its own credentials.

The two kinds of variable

Saved on a client. You fill these in, per client, in the client's Variables panel. A row appears there as soon as a switched-on flow attached to the client uses the token; press Set value to fill it in. Written {{name}}. Use them for anything that differs between clients or that you would rather not type into a flow: passwords, home coordinates, a shop command.

Set while the flow runs. These come from the flow itself (the set variable block) or are handed over by a trigger, like {{var:player}} on a player-join. Written {{var:name}}. They live only as long as the client runs; stopping it clears them.

In the editor, drop the variable block from the Variables category into any field: give it a name, a default (leave it empty to make the value required) and choose plain or secret. A value set while the flow runs is read back with {{var:name}}.

Names use lower-case letters, numbers and underscores, up to 40 characters.

Required and optional

A bare token is required: the client lists it as needed until you give it a value.

{{name|fallback}} is optional: the fallback is used while nothing is set, and the client does not ask for it. Good for a value with a sensible default:

A missing required value stops the client from starting. The client shows a notice, 2 variable(s) still need a value, and a start is refused until you fill them in.

Secrets

A variable is secret when a flow marks it secret (its token reads {{secret:name}}), or when its name looks like a credential (password, token, pin and the like). The Variables panel tags each row secret or plain. A secret is:

• encrypted at rest,
• never shown again once saved (the panel displays •••••••• (set)),
• never returned to the editor,
• never printed in the client's log or console.

Deleting one is final: the stored value cannot be recovered, and any flow using it sends nothing in its place.

The password used by the login and register blocks is exactly this: a variable named password, tagged secret.

Logging in without typing a password into a flow

The editor's Log in and Register blocks write the reference for you:

Most login plugins want you to register once and then log in on every later join, so the usual pair is a register flow hanging off a chat trigger that matches the server's "please register" line, plus a login flow on join.

Change the command if your server uses /l, /log, /reg or /signup instead.

Reading the client's own state into a variable

read state writes a live fact (health, position, held item, ping) into a variable, so a flow can report it or test it: