Analytics preference

We only load Google Analytics after you opt in. You can change this choice at any time from Cookie settings.

Credentials

Credentials store API keys and secrets used by workflow nodes. You add them in the Credentials Tab and reference them by name in node configuration.

Credentials store API keys and secrets used by workflow nodes. You add them in the Credentials Tab and reference them by name in node configuration.

What Credentials Are

  • Stored per user – Each credential belongs to a user and can be shared with other users or Teams.
  • Encrypted at rest – Sensitive values are encrypted; the UI masks them after creation.
  • Referenced by name – Nodes select a credential by name (or ID). The execution engine resolves the credential for the workflow owner at run time.

How Nodes Use Them

Node typeTypical credentialPurpose
LLM, AgentOpenAI, Google, CustomAPI key for the model
CodexOpenAI Codex + GitHubChatGPT subscription sign-in (OAuth) or a Codex access token for the runner, plus a GitHub PAT for repository operations
OpenCode GoOpenCode Go + GitHubAn OpenCode Go gateway API key (optional base URL) for the runner, plus a GitHub PAT for repository operations
Agent, HTTP, GitHubGitHubGitHub personal access token (PAT) for GitHub API calls, GitHub node operations, and MCP integrations
JiraJiraCloud email/API token or Data Center username/password, Jira site base URL, deployment mode, and optional REST API version
LinearLinearPersonal API key or OAuth2 for teams, projects, issues, and comments
HTTPBearer, HeaderAuth for requests
Telegram, Telegram TriggerTelegramBot token and optional webhook secret
DiscordDiscordIncoming webhook URL
Discord TriggerDiscord Trigger (Public Key)Application public key for signature verification
RAGRAG: Qdrant + OpenAI, RAG: Psql + OpenAI, RAG: Custom EmbeddingsVector store connection (external Qdrant, or Heym's own Postgres via pgvector), with OpenAI or any OpenAI-compatible embedding endpoint
SlackSlackWebhook or API token
IMAP TriggerIMAPInbound mailbox connection
Send EmailSMTPMail server
RedisRedisConnection
GristGristAPI key + server URL
Google SheetsGoogle Sheets (OAuth2)Client ID + Client Secret + OAuth2 consent
Google DriveGoogle Drive (OAuth2)Client ID + Client Secret + OAuth2 consent
BigQueryBigQuery (OAuth2)Client ID + Client Secret + OAuth2 consent
SupabaseSupabaseProject URL + API key (+ optional default schema)
ClickHouseClickHouseHost + port + username/password + database (+ secure)
NotionNotionInternal integration token, or public integration Client ID + Client Secret + OAuth consent
SentrySentryAuth token plus optional self-hosted base URL
Amazon S3Amazon S3Access key, secret key, region
RabbitMQRabbitMQAMQP URL

For detailed setup (hosts, ports, provider-specific fields), see Third-Party Integrations. That includes Telegram bot setup, inbound email via IMAP, and outbound email via SMTP.

GitHub credentials can also include an optional base_url when you are targeting GitHub Enterprise Server instead of GitHub.com. When you edit a GitHub credential to rotate the token, leaving base_url empty preserves the existing Enterprise endpoint. Enter a new URL only when you want to change that endpoint.

Jira, Linear, Supabase, Notion, Sentry, and ClickHouse credentials expose Test Connection in the credential dialog. For Jira, the check calls Jira's current user endpoint. For Linear, the check calls the Linear API with getViewer and confirms the API key or OAuth token is valid. When editing, you can test without re-entering the API key if the stored secret is still present. For Notion, choose Internal token or OAuth in the dialog; OAuth uses the Client ID and Client Secret from your Notion public integration. See Third-Party Integrations for Notion setup details.

Coding-package usage

The AI Defaults tab in Settings shows remaining coding-package usage for your Codex credentials (owned and shared). For each Codex credential it renders a horizontal bar per active rate-limit window — typically a 5 hours and/or Weekly window, depending on your plan — with the percentage of quota left and a reset countdown. The data comes from the Codex backend's rate-limit response headers, fetched on demand.

OpenCode Go credentials are listed there too, but marked "usage unavailable": the OpenCode zen gateway does not expose remaining-quota data, so no bar can be shown.

In Expressions

Some nodes allow expressions for auth. Use Expression DSL with $credentials.CredentialName to reference a credential's resolved secret inside an expression.

Codex credentials are intentionally excluded from $credentials. Whether you sign in with ChatGPT (subscription, no per-token API cost) or paste a Codex access_token, the tokens are only passed to the local Codex runner process. ChatGPT sign-in tokens are refreshed automatically as they expire.

Jira credentials are also excluded from $credentials. The Jira node loads the credential by credentialId at run time. For custom Jira REST calls not covered by the Jira node, use the HTTP node with Jira Basic Auth (email:api_token for Jira Cloud or username:password for Data Center / Server), for example curl -u you@example.com:YOUR_API_TOKEN https://your-domain.atlassian.net/rest/api/3/myself. You can also use a Header credential with Authorization: Basic <base64(user:secret)>. Jira Data Center / Server personal access tokens and Bearer auth are not supported by the Jira credential yet.

Credential typeValue exposed to $credentials.Name
BearerBearer token string
GitHubPersonal access token
NotionInternal api_token or OAuth access_token (Bearer token for Notion API calls)
SentrySentry auth token
Discord / SlackWebhook URL

Example:

$credentials.MyBearerToken
$credentials.MyNotionWorkspace

Use the Notion node for native database, page, and block operations. Use $credentials when a custom HTTP request needs the same Notion bearer token.