API keys and credentials

Project credentials let applications send traces or query project data without signing into the dashboard. Choose an ingestion key for trace export, or an MCP credential for an external assistant:

Credential	Access
Ingestion key (hbi_…)	Sends OTLP traces to /v1/traces for one project. It does not grant MCP or dashboard access.
MCP credential (hbm_…)	Connects a client to /mcp for one project, with selected additional capabilities.

Owners and admins manage both under Settings → Project settings → API keys. Give separate exporters and clients descriptive credentials so one can be revoked without interrupting the others.

For creation and initial configuration, follow Set up your project or External assistants through MCP. Store secrets immediately when shown; saved records cannot reveal their original value. Keep them in server-side secret storage or the client’s private environment, outside source control.

Replace an ingestion key

Create a replacement key and update the application’s secret configuration. Confirm that fresh traces reach the intended project, then revoke the old key.

This overlap lets you migrate running exporters before removing their old access. Revocation stops further ingestion with that key without deleting telemetry already stored.

Rotate an MCP credential

Rotation returns a new secret for the same credential record and invalidates the previous secret. Update the client and reconnect. Clients still using the old token will fail authentication.

Capabilities are chosen at creation and cannot be added later. Create a replacement credential if the client’s required authority changes.

Review MCP access

Use expiry, last-use metadata and credential history to review connected clients. MCP credentials created in the dashboard have no expiry; a credential created with an expiry through the API stops authenticating at that time. History records creation, rotation, revocation and first use. Later requests update last-use metadata, so history is not a record of every MCP call.

Revoke a credential

Revoke credentials for retired clients or exposed secrets. Revocation is permanent, and MCP checks it on subsequent requests. Expired credentials also cannot authenticate. Removing a team member does not revoke service credentials they received.

External tool connections, Vapi API keys, Slack links, and simulation sign-in secrets have separate lifecycles. Manage them on their respective tools, Vapi, Slack, or simulation settings pages.