---
title: "Secrets and API keys"
description: "Per-project credentials, and keys for programmatic access to a project."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.heizen.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets and API keys

## Secrets

**Secrets** stores the per-project credentials that runs and integrations need —
kept with the project rather than pasted into a config somewhere.

## API keys

**Settings → API keys** issues keys for programmatic access. A key belongs to
exactly one project, and that scope is enforced: it can't reach another
project's data.

Each key carries an explicit permission list:

`bug:read` `bug:write` · `story:read` `story:write` · `tests:read` `tests:write` ·
`docs:read` `docs:write` · `worklog:read` `worklog:write` · `meeting:read` `meeting:write` ·
`integration:read` `integration:write` · `api:read` `api:write`

Keys can be given an expiry, disabled, or deleted from the same page. Only the
prefix is shown after creation — copy the full key when it's issued.

> **Keys are for automation**
>
> A key is the right credential for CI, a scheduled job or a bot. When a person
> is at the keyboard, connect over [Heizen MCP](/mcp/authentication) and sign in
> with OAuth instead — no credential to store, and the session carries your own
> Studio permissions. Full detail: [API keys for CI and bots](/mcp/api-keys).

Source: https://docs.heizen.work/studio/secrets-and-api-keys/index.mdx