Code block

The Code block (type: "code") runs a short JavaScript function in a sandbox and stores what it returns, so later steps can use it. It has no plain-language guide; to map or filter records without writing code, see the Transform block.

When to use it

• Calculate or reshape values that a template reference cannot express, such as summing invoice lines or grouping payments by customer.
• Decode or re-encode base64 file content between steps.
• Prepare a payload for the next step when an integration expects a specific structure.

The sandbox has no network or file access. To call an HTTP API, use the API Request block.

A Code step cannot use workflow secrets. A {{secrets.KEY}} reference anywhere in its config (including input) is refused when the workflow is saved, and a stored workflow that has one fails at run start. Call the API that needs the secret in an API Request step and pass its output to the code step through input.

Configuration

What the code can use

• input, plus standard JavaScript built-ins such as JSON, Math, Date, Array, Object, Map, Set, RegExp and Promise.
• atob, btoa, TextEncoder, TextDecoder, typed arrays and a base64 helper for converting between base64 text and bytes.
• The libraries in allowedLibraries. These are safe subsets of the named libraries, exposed as globals (lodash.map(...)), not full packages.

console output is not captured by default.

Output

The step stores this object. Reference it as {{steps.<step id>.<field>}}.

The editor's output list also shows logs; the executor does not return that field.

Example

This workflow lists open Stripe invoices, then totals the amount due per customer.

{
  "name": "Open invoice totals by customer",
  "trigger": { "type": "api" },
  "steps": [
    {
      "id": "list_invoices",
      "type": "action",
      "name": "List open invoices",
      "action": "stripe.listInvoices",
      "config": { "status": "open" }
    },
    {
      "id": "total_by_customer",
      "type": "code",
      "name": "Total amount due by customer",
      "config": {
        "language": "javascript",
        "input": { "invoices": "{{steps.list_invoices.data}}" },
        "code": "const totals = {};\nfor (const inv of input.invoices || []) {\n  totals[inv.customer] = (totals[inv.customer] || 0) + inv.amount_due / 100;\n}\nreturn { totals, count: Object.keys(totals).length };",
        "sandbox": { "timeoutMs": 10000 }
      }
    }
  ]
}

A later step reads the totals as {{steps.total_by_customer.result.totals}}.

Errors and limits

• Security scan. With codeReview on, the code text (comments excluded) is scanned before it runs, and code that matches a blocked pattern is rejected. Blocked patterns include eval(, Function, require(, import, process., globalThis, any constructor or __proto__ reference, built-in prototypes such as Object.prototype, Reflect.apply, file system calls and network calls such as fetch(. The scan matches text, so a property or string that contains one of these words is rejected too. Comments are ignored, and a method call such as /re/.exec(text) is allowed. The step fails with Code step failed [security] and the matched lines.
• Runtime errors. A thrown error fails the step with Code step failed [runtime] and the error message.
• Time limit. Code that runs longer than its limit (sandbox.timeoutMs, else timeout, else 5000 ms) fails the step. The ceiling is 30000 ms (30 s); a higher value is lowered to it, and 0 or a negative value is raised to 100 ms.
• Output size. A returned value larger than sandbox.maxOutputSize as JSON fails the step with Code step failed [output_size]. Return only the fields later steps need, or raise the limit up to 10 MiB.
• Use errorHandling on the step to continue or retry after a failure. See Errors, retries and timeouts.