Secrets
Secrets stores the per-project credentials that runs and integrations need — kept with the project rather than pasted into a config somewhere.
API keys
Settings → API keys issues keys for programmatic access. A key belongs to exactly one project, and that scope is enforced: it can’t reach another project’s data.
Each key carries an explicit permission list:
bug:read bug:write · story:read story:write · tests:read tests:write ·
docs:read docs:write · worklog:read worklog:write · meeting:read meeting:write ·
integration:read integration:write · api:read api:write
Keys can be given an expiry, disabled, or deleted from the same page. Only the prefix is shown after creation — copy the full key when it’s issued.