Add Variables and Connections to Code

A connection stores everything a script needs to talk to a third-party system — credentials, host, and any other fields a given connection type defines — under a single workspace-scoped path. Variables (and secret variables) do the same for arbitrary values you don’t want hardcoded into a script: API keys, feature flags, small pieces of config.

Connections

Scripts read a connection one of two ways.

Passing connections as parameters to scripts (preferred)

Declare a parameter typed as a connection type and Orvanta resolves it to the selected connection’s value at run time — no fetch call needed in the script body. This is the preferred approach because the connection becomes a visible, typed input rather than something buried in the script logic.

From the code editor’s toolbar, click the + Type button and pick the connection type the parameter should accept. For example, to type a parameter as a PostgreSQL connection:

TypeScript:

type Postgresql = object;
// OR fully typed:
type Postgresql = {
  host: string;
  port: number;
  user: string;
  dbname: string;
  sslmode: string;
  password: string;
  root_certificate_pem: string;
};
export async function main(postgres: Postgresql) {
  // Use Resource...
}

Python:

from typing import TypedDict
class postgresql(TypedDict):
    host: str
    port: int
    user: str
    dbname: str
    sslmode: str
    password: str
    root_certificate_pem: str
def main(selected_postgres: postgresql):
    # Use Resource...

Pick the actual connection to use in the arguments panel on the right — you can also open, edit, or create one from there without leaving the code editor.

Fetching connections within scripts

Use this when the connection isn’t a top-level parameter — for example, a script that needs to look up a connection by a path built at runtime. Click + Resource in the toolbar to pick one from the workspace and fetch it directly:

TypeScript:

orvanta.getResource('u/user/foo');

Python:

orvanta.get_resource("u/user/foo")

Go:

orvanta.GetResource("u/user/foo")

Bash:

curl -s -H "Authorization: Bearer $OV_TOKEN" \
  "$BASE_INTERNAL_URL/api/w/$OV_WORKSPACE/resources/get/u/user/foo" \
  | jq -r .value

Contextual variables

Contextual variables are set by the worker for every job, not by you — things like which workspace and workflow triggered the run, or the job’s own ID. The one you’ll reach for most is the ephemeral job token: it lets a script authenticate back against the Orvanta API with exactly that job’s permissions, without you having to manage a credential yourself.

Click +Context Var in the toolbar to insert one. As environment variables, they show up under names such as OV_TOKEN for the token.

User-defined variables

There are two ways to bring a variable into a script.

Passing variables as parameters

Use the variable picker to bind a script parameter to a variable. Under the hood this stores the parameter as a string like $var:<variable_path>, which the worker resolves to the real value right before the job runs — the script itself never sees the path, only the resolved value. If the identity running the job can’t read that variable, the job fails rather than silently getting an empty value.

Fetching variables within scripts

For a variable path that isn’t known until run time, fetch it directly from the script instead of binding it as a parameter. Click + Variable in the toolbar to insert the call for a variable you pick from the workspace:

TypeScript:

orvanta.getVariable('u/user/foo');

Python:

orvanta.get_variable("u/user/foo")

Go:

orvanta.GetVariable("u/user/foo")

Bash:

curl -s -H "Authorization: Bearer $OV_TOKEN" \
  "$BASE_INTERNAL_URL/api/w/$OV_WORKSPACE/variables/get/u/user/foo" \
  | jq -r .value

The Bash example shows what the typed clients do for you in every other language: it calls the workspace API directly, authenticating with the job’s own ephemeral token rather than a long-lived credential.