# Keys and environments

> Agent, owner and app keys, what each may do, the development environment, and where the project id is.

- **Agent key** (`vz_sk_…`, access `agent`): what the MCP server and the CLI usually hold. Builds and runs: projects, deploys, actions, AI, usage, the development env, everything in development. Never a production secret, never live money: production refunds, cancels, withdrawals, payment settings, keys, removing domains and connecting hosts answer `403 owner_only`. The fix for `owner_only` is a person: the owner does it in the console (or with an owner key), not a retry.
- **Owner key** (access `owner`): all of that plus production secrets, keys, removing domains and connecting hosts. Rarely given to agents.
- **App key** (`vz_app_…`, `VIBIZ_APP_KEY`): the running app's one secret, per environment.

**Development env** (`vibiz_dev_env`, `vibiz dev`): its own database branch with the app's tables and no production rows, its own sign-in (trusts `http://localhost:3000`), its own AI key, and `VIBIZ_WEBHOOK_SECRET` once a development webhook is set. `write_to` puts the values in an env file without showing them.

**The project id**: `./vibiz.json` `{ "project_id": "prj_…" }` in a linked app folder, or `vibiz_project_status` for the list. Read it instead of asking the user.