Keys for your own code, apps for products that connect through OAuth, and the secret that verifies inbound webhooks.