Project developer settings

One screen holds every credential and every outbound hook a project has.

Owners and admins.

Settings → Developer has four sections.

API tokens: "Project-owned tokens for the CLI and CI. The token value is shown only once, at creation."

Publishable keys: "Create one to embed the in-context editor SDK in your app." These are meant to be public; they are restricted by the site addresses you allow rather than by being kept secret.

Webhooks: "POST a signed event to your endpoint when something changes."

Runtime delivery (CDN): the published-locale URLs and the read-only keys that fetch them. "Create one to read published locales from the edge."

The pattern across all four is the same and worth internalising: the secret half is shown once, at creation, and is never recoverable. transglot stores a hash, not the value. If you lose one, you mint a new one and revoke the old.