> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/secret-pii-scan/heeler-secrets.md).

# Heeler Secrets

You can connect OX to your Heeler instance to import its secrets findings. This lets you review exposed secrets and credentials alongside your other findings in the OX platform.

Heeler detects secrets, tokens, and other sensitive values exposed in your code. OX reads those results through the Heeler API, maps them to your applications, and presents them for triage, prioritization, and reporting.

After connecting, you see Heeler results on the **Active issues** page. Filter by **Source tool > Heeler** to focus on them.

## What OX adds

* **Context and correlation:** OX maps Heeler secrets findings to applications, repositories, and services to show impact and ownership.
* **Prioritization with severity factors:** OX reprioritizes vendor severities when exploitability and environment context change the risk. Severity factors explain why the priority changed.
* **Unified queue:** Heeler secrets findings appear as OX issues under Secret/PII Scan, so you triage exposed credentials next to results from your other scanners.

## Terminology mapping

Heeler and OX use different labels for similar concepts. Use this map while you work.

| Heeler term                | What it includes                              | OX equivalent                    |
| -------------------------- | --------------------------------------------- | -------------------------------- |
| **Secrets**                | Exposed tokens, keys, and credentials in code | **Issues** (secrets)             |
| **Repositories, services** | Scanned code units                            | **Applications**                 |
| **Severity**               | Vendor severity rating                        | **Issues with severity factors** |

## Prerequisites

* **OX permissions:** Permission to configure connectors.
* **Heeler API token:** An API token from your Heeler account, from Step 1.

## Step 1: Generate an API token \[Heeler]

Heeler authenticates API requests with an API token generated from your Heeler account.

1. Sign in to **Heeler** at `https://app.heeler.com`. Self-hosted deployments use your own instance URL.
2. Go to your account or organization settings.
3. Generate an API token.
4. Copy the token and store it in a secure location.

## Step 2: Determine your host URL

OX connects to Heeler at your instance base URL. Cloud tenants use `https://app.heeler.com`. Self-hosted deployments use their own instance URL. Confirm the value in your browser address bar while signed in to Heeler.

## Step 3: Connect Heeler to OX \[OX]

1. In OX, go to **Connectors**.
2. In the search box, enter `Heeler`. The Heeler connector appears under **Secret/PII Scan**.
3. Select the **Heeler** card to open the **Configure your Heeler credentials** dialog.

<figure><img src="https://884876233-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdK3XMLdV8zRg847RmGmZ%2Fuploads%2Fgit-blob-6f5708ec2107590e3484804340507f83d01b776e%2Fheeler-secrets-dialog-crop.png?alt=media" alt="" width="456"><figcaption></figcaption></figure>

4. On the **Token** method, enter the following details.

| Field               | What to use                                                                                                                    |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| **Heeler Host URL** | The base URL of your Heeler instance, for example `https://app.heeler.com`. Self-hosted deployments use your own instance URL. |
| **API Token**       | The API token you created in Step 1.                                                                                           |

5. Select **Verify Connectivity** to confirm the credentials, then select **Connect**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ox.security/ox-integrations/3rd-party-integrations/secret-pii-scan/heeler-secrets.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.