- Agent key (
vz_sk_…, accessagent): what the MCP server and the CLI usually hold. Builds and runs: projects, deploys, actions, AI, usage, the development env, everything in development. Never a production secret, never live money: production refunds, cancels, withdrawals, payment settings, keys, removing domains and connecting hosts answer403 owner_only. The fix forowner_onlyis a person: the owner does it in the console (or with an owner key), not a retry. - Owner key (access
owner): all of that plus production secrets, keys, removing domains and connecting hosts. Rarely given to agents. - App key (
vz_app_…,VIBIZ_APP_KEY): the running app's one secret, per environment.
Development env (vibiz_dev_env, vibiz dev): its own database branch with the app's tables and no production rows, its own sign-in (trusts http://localhost:3000), its own AI key, and VIBIZ_WEBHOOK_SECRET once a development webhook is set. write_to puts the values in an env file without showing them.
The project id: ./vibiz.json { "project_id": "prj_…" } in a linked app folder, or vibiz_project_status for the list. Read it instead of asking the user.