HelixDB Docs

Reference

Owners and admins need the workspace-scoped service_credentials.manage permission.

helix service-credential create --workspace <id> --name <name> \
  --grant <project-id>=project-read,query-read [--expires-at <RFC3339>]
helix service-credential list --workspace <id>
helix service-credential get --workspace <id> <credential-id>
helix service-credential update --workspace <id> <credential-id> \
  [--name <name>] [--grant <project-id>=query-read,query-write] \
  [--expires-at <RFC3339> | --clear-expiry]
helix service-credential revoke --workspace <id> <credential-id> --yes

Each grant is project-scoped and must name a project inside the owning workspace. Available grants are project-read, project-write, query-read, and query-write; write requires its matching read. Creation displays the secret once. Updates never reveal or rotate it. Service credentials authenticate headless API/MCP automation. They are never a CLI login method and the CLI never persists them.

⌘I

Using the helix CLI

CLI Command Reference

helix service-credential