> ## Documentation Index
> Fetch the complete documentation index at: https://docs.helix-db.com/llms.txt
> Use this file to discover all available pages before exploring further.

# helix service-credential

> Manage workspace-owned credentials for headless API and MCP clients

<div className="flex flex-wrap gap-2"><Badge color="gray" size="sm">Reference</Badge></div>

Owners and admins need the workspace-scoped `service_credentials.manage` permission.

```bash theme={"languages":{"custom":["languages/helixql.json"]}}
helix service-credential create --workspace <id> --name <name> \
  --grant <project-id>=project-read,query-read [--expires-at <RFC3339>]
helix service-credential list --workspace <id>
helix service-credential get --workspace <id> <credential-id>
helix service-credential update --workspace <id> <credential-id> \
  [--name <name>] [--grant <project-id>=query-read,query-write] \
  [--expires-at <RFC3339> | --clear-expiry]
helix service-credential revoke --workspace <id> <credential-id> --yes
```

Each grant is project-scoped and must name a project inside the owning workspace. Available grants
are `project-read`, `project-write`, `query-read`, and `query-write`; write requires its matching read.
Creation displays the secret once. Updates never reveal or rotate it.

Service credentials authenticate headless API/MCP automation. They are never a CLI login method and
the CLI never persists them.