HelixDB Docs

Reference

Owners and admins need the workspace-scoped service_credentials.manage permission.

helix service-credential create --workspace <id> --name <name> \
  --grant <project-id>=project-read,query-read [--expires-at <RFC3339>]
helix service-credential list --workspace <id>
helix service-credential get --workspace <id> <credential-id>
helix service-credential update --workspace <id> <credential-id> \
  [--name <name>] [--grant <project-id>=query-read,query-write] \
  [--expires-at <RFC3339> | --clear-expiry]
helix service-credential revoke --workspace <id> <credential-id> --yes

Each grant is project-scoped and must name a project inside the owning workspace. Available grants are project-read, project-write, query-read, and query-write; write requires its matching read. Creation displays the secret once. Updates never reveal or rotate it. Service credentials authenticate headless HTTP API calls and, where deployed, the separate Admin MCP service. They do not authenticate the public unified MCP endpoint. They are never a CLI login method and the CLI never persists them.

Using the helix CLI

CLI Command Reference

helix service-credential