What are Postman variable scopes and how do you use environments?

The scopes

Postman variables are referenced with double curly braces, {{baseUrl}}/users/{{userId}}, in URLs, headers and bodies. A value can live in several scopes:

Scope	Lives in	Typical use
Global	Workspace	Rarely; quick experiments
Collection	The collection	Values every request in the collection needs, such as API version
Environment	An environment you select	Per-stage values: baseUrl, client ids, test user names
Data	The CSV/JSON file in a collection run	One value per iteration
Local	A single request execution, set in a script	Temporary values that should not persist

Precedence

When the same name exists in several scopes, the narrowest scope wins: local, then data, then environment, then collection, then global. So a data file can override an environment value for one iteration, and an environment can override a collection default. Unresolved variables show in red in the app and are sent literally as {{name}}, which is a common cause of confusing 404s.

Environments

Create one environment per stage (dev, staging) with the same variable names and different values, then switch with the dropdown or pass -e staging.postman_environment.json to Newman. The requests never change; only the environment does. Never point a destructive collection at production by accident: name production environments clearly or keep them out of test workspaces.

Reading and writing in scripts

// Read whichever scope resolves first
const base = pm.variables.get("baseUrl");

// Write to a specific scope
pm.environment.set("authToken", pm.response.json().access_token);
pm.collectionVariables.set("apiVersion", "v2");

// Local: only for this execution
pm.variables.set("tempId", "abc");

pm.environment.unset("authToken");

pm.variables.get follows the precedence chain, while pm.environment.get reads only the environment.

Secrets

Each variable has an initial value (synced and shared with anyone who has access to the workspace or exports the file) and a current value (local to you). Put real tokens and passwords only in current values, mark them as the secret type so they are masked, or use Postman Vault for local secrets. In CI, inject secrets with --env-var in Newman from the CI secret store instead of committing environment files that contain them.

What interviewers look for

• Knowing the five scopes and that the narrowest wins.
• Using environments to run the same collection against multiple stages.
• Correct pm.* calls for setting variables in the right scope.
• Awareness that initial values are shared and secrets must not leak.