Console and API keys
Use app.heygrc.com to manage API keys, review modes, and org settings for heyGRC.
The heyGRC console is app.heygrc.com. It is the human UI for the same control plane your agent configures via the API.
Sign in and org
Sign in at app.heygrc.com with GitHub, Google, Microsoft, or email. After you install the GitHub App, link the installation to a heyGRC org in the console (owner/admin path on GitHub). One heyGRC org maps to one GitHub App installation.
Signing in with GitHub is the console account. Connecting the GitHub App (install + claim) is a separate step.
Connected repositories
On Reviews, heyGRC lists the repositories your GitHub App installation can access, even before the first pull request.
- If you granted access to all repositories, Reviews shows one line for that GitHub account.
- If you selected specific repositories, Reviews lists those names. Repositories without a pull request yet show as waiting for one.
- Change which repositories heyGRC can see in the GitHub App settings. The console does not have its own repository picker.
Older installs are not backfilled automatically. If Reviews says repository selection has not synced yet, open the heyGRC GitHub App settings and save your repository selection again.
API keys
Settings → API keys → Create key.
- Keys look like
hgrc_…and are shown once at creation. Store them as secrets. - Each key belongs to one org and carries scopes such as
config:readandconfig:write. - Send the key only as
Authorization: Bearer hgrc_…. Keys in query strings are rejected. - Revoke keys you no longer need from the same settings page.
Agents should never invent keys or put them in URLs. See API reference.
Plan page
Settings → Plan is where billing lives: current plan, included private reviews, usage for the month, on-demand switch, checkout and portal.
Included with ISMS Copilot
If the signed-in account pays for a qualifying ISMS Copilot plan (Standard, Pro, Business) and the org has no heyGRC subscription, the Plan page offers to activate the inclusion. Once activated the page shows:
- An included with ISMS Copilot badge instead of a plan name.
- A usage bar, used of 100, for the current month. The count follows your account, not the org.
- Move to another org: release the inclusion here, then activate it on the other org. Reviews already used this month stay used.
- No Stripe portal, no top-ups, no on-demand switch. Need more, pick a heyGRC plan from the same page; it applies instead of the inclusion.
- A paused state when included access is temporarily unavailable, and the same if the ISMS Copilot subscription lapses. The org falls back to Free rules and keeps its install, settings and history. The inclusion resumes on its own, with the same month balance, when access or the subscription is back.
Sign in with the same account you use for ISMS Copilot, or the offer will not appear. Details: Pricing and plans.
Review mode
In the console you set how often heyGRC runs (auto, auto_once, mention_only), with optional per-repository overrides. Details: What a review looks like.
Language
Two separate settings, both in Settings:
- Console language is your personal language for this console (navigation, Settings, buttons). Pick
en,de,es,fr,it,nl, orpl. Details: Console language. - Review language is the org-wide language of the GitHub compliance review comments (same set of languages). Control IDs, the heyGRC check name, and already-posted comments are unchanged. Details: Review language.
EU inference
Settings → EU inference. Off by default. When on, this org's compliance reviews use Mistral on the EU regional endpoint and will not fall back to the global path. Confirm the dialog before enabling: quality and large-PR coverage can differ, and a failed EU call fails the review.
Same setting via the API: sticky eu_inference on GET/PUT /v1/config. Full customer page: EU inference.
Appearance
The console follows system light/dark appearance and can be pinned under Settings.