The Credentials tab manages API keys and secrets used by nodes. Add credentials here and reference them by name in workflow nodes. For an overview of what credentials are and how nodes use them, see Credentials.
Credential Types
| Type | Use Case |
|---|---|
| OpenAI | OpenAI API key for LLM, Agent, and RAG nodes |
| Google AI (Gemini) API key | |
| GitHub | GitHub personal access token (PAT) for GitHub API, GitHub node workflows, MCP servers, and agent workflows; optional GitHub Enterprise base_url |
| Linear | Linear personal API key or OAuth2 for teams, projects, issues, and comments |
| Notion | Internal integration token or public-integration OAuth workspace authorization |
| Custom | Custom LLM endpoints |
| Bearer | Bearer token for HTTP auth |
| Header | Custom header key-value for HTTP requests |
| Telegram | Telegram bot token and optional webhook secret |
| Slack | Slack incoming webhook URL |
| Discord | Discord incoming webhook URL |
| Discord Trigger | Discord application public key |
| IMAP | Inbound mailbox trigger credentials |
| SMTP | Email sending credentials |
| Redis | Redis connection |
| RAG: Qdrant + OpenAI | Vector store for RAG nodes, backed by an external Qdrant server |
| RAG: Psql + OpenAI | Vector store for RAG nodes, backed by Heym's own Postgres database (pgvector) — no external service |
| RAG: Custom Embeddings | Vector store for RAG nodes using any OpenAI-compatible embedding endpoint, with Qdrant or Postgres (pgvector) as the store |
| Cohere | Cohere API for embeddings |
Adding Credentials
- Click Add Credential
- Choose the credential type
- Enter the required values (API key, URL, etc.)
- Give it a name for reference in nodes
For GitHub, the current credential flow is PAT-based. Fine-grained PATs are recommended. GitHub App installation flows are not first-class in the UI today. If you use GitHub Enterprise Server, you can also set an optional GitHub API base URL such as https://github.example.com/api/v3.
For Linear, choose Personal API key or OAuth2 in the dialog. Personal API keys are created
under Settings → Security & Access → Personal API keys in Linear. OAuth2 uses a Linear OAuth
application Client ID and Client Secret, with {FRONTEND_URL}/api/credentials/linear/oauth/callback
registered as the redirect URI. The credential acts with the permissions of the Linear user who
created or authorized it. Use Test Connection in the credential dialog to verify the API key or
OAuth token before saving.
For Notion, choose Internal token or OAuth in the dialog. OAuth uses the Client ID and Client Secret from your Notion public integration; Heym stores them encrypted in the credential. Use Test Connection to verify Supabase, Linear, or Notion credentials before saving a workflow. See Third-Party Integrations for Notion setup details.
Editing and Deleting
- Edit – Update credential values (sensitive values are masked)
- Delete – Remove a credential; workflows using it will need a replacement
When editing a GitHub credential on GitHub Enterprise Server, leaving the optional GitHub API Base URL empty preserves the existing Enterprise endpoint. Enter a new URL only when you want to change that endpoint.
Sharing
- Share credentials with other users by email or with Teams
- Shared credentials appear with an indicator
- Revoke sharing from the credential card menu
Using in Nodes
Reference credentials by name in node configuration. For example:
- LLM node – Select credential for the model API
- HTTP node – Use Bearer or Header credentials for auth
- Agent node – Pass GitHub tokens into MCP server env vars such as
GITHUB_PERSONAL_ACCESS_TOKEN - GitHub node – Run native GitHub repository, user, issue, review, release, workflow, traffic, and file operations
- Linear node – Read workspace metadata and automate Linear issues and comments
- Notion node – Manage Notion databases, data sources, pages, and blocks
- RAG node – Use a Qdrant or Postgres (pgvector) credential for the vector store
- Telegram Trigger node – Receive Telegram bot webhooks
- Telegram node – Send Telegram bot messages
- Discord Trigger node – Receive Discord interaction webhooks
- Discord node – Send Discord webhook messages
- IMAP Trigger node – Poll a shared inbox for new email
See Expression DSL for referencing credential-backed values in expressions.
Related
- Third-Party Integrations – Detailed setup guide for each credential type (Telegram, Discord, Qdrant, Grist, IMAP, SMTP, RabbitMQ, Redis, Slack, and more)
- Credentials Sharing – Share credentials with other users
- Security – Encryption at rest, session management, rate limiting
- Node Types – Nodes that use credentials (LLM, Agent, GitHub, Linear, RAG, HTTP, Telegram, Telegram Trigger, Discord, Discord Trigger, Slack, IMAP Trigger, Send Email, Redis)
- Vectorstores Tab – Uses Qdrant or Postgres (pgvector) credentials
- Chat Tab – Uses OpenAI/Google credentials
- Contextual Showcase – Compact page guide for dashboard surfaces