> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/secret-pii-scan/heeler-secrets.md).

# Heeler Secrets

You can connect OX to your Heeler instance to import its secrets findings. This lets you review exposed secrets and credentials alongside your other findings in the OX platform.

Heeler detects secrets, tokens, and other sensitive values exposed in your code. OX reads those results through the Heeler API, maps them to your applications, and presents them for triage, prioritization, and reporting.

After connecting, you see Heeler results on the **Active issues** page. Filter by **Source tool > Heeler** to focus on them.

## What OX adds

* **Context and correlation:** OX maps Heeler secrets findings to applications, repositories, and services to show impact and ownership.
* **Prioritization with severity factors:** OX reprioritizes vendor severities when exploitability and environment context change the risk. Severity factors explain why the priority changed.
* **Unified queue:** Heeler secrets findings appear as OX issues under Secret/PII Scan, so you triage exposed credentials next to results from your other scanners.

## Terminology mapping

Heeler and OX use different labels for similar concepts. Use this map while you work.

| Heeler term                | What it includes                              | OX equivalent                    |
| -------------------------- | --------------------------------------------- | -------------------------------- |
| **Secrets**                | Exposed tokens, keys, and credentials in code | **Issues** (secrets)             |
| **Repositories, services** | Scanned code units                            | **Applications**                 |
| **Severity**               | Vendor severity rating                        | **Issues with severity factors** |

## Prerequisites

* **OX permissions:** Permission to configure connectors.
* **Heeler API token:** An API token from your Heeler account, from Step 1.

## Step 1: Generate an API token \[Heeler]

Heeler authenticates API requests with an API token generated from your Heeler account.

1. Sign in to **Heeler** at `https://app.heeler.com`. Self-hosted deployments use your own instance URL.
2. Go to your account or organization settings.
3. Generate an API token.
4. Copy the token and store it in a secure location.

## Step 2: Determine your host URL

OX connects to Heeler at your instance base URL. Cloud tenants use `https://app.heeler.com`. Self-hosted deployments use their own instance URL. Confirm the value in your browser address bar while signed in to Heeler.

## Step 3: Connect Heeler to OX \[OX]

1. In OX, go to **Connectors**.
2. In the search box, enter `Heeler`. The Heeler connector appears under **Secret/PII Scan**.
3. Select the **Heeler** card to open the **Configure your Heeler credentials** dialog.

<figure><img src="/files/qXt5GCxXnVfShlS17ysl" alt="" width="456"><figcaption></figcaption></figure>

4. On the **Token** method, enter the following details.

| Field               | What to use                                                                                                                    |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| **Heeler Host URL** | The base URL of your Heeler instance, for example `https://app.heeler.com`. Self-hosted deployments use your own instance URL. |
| **API Token**       | The API token you created in Step 1.                                                                                           |

5. Select **Verify Connectivity** to confirm the credentials, then select **Connect**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ox.security/ox-integrations/3rd-party-integrations/secret-pii-scan/heeler-secrets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.