Fixed. Someone else had set up heroku deployment using the default circleci ui. This was resetting credentials to ones invalid for the actions I was carrying out with the cli.
Bit of feedback for the circle team - please make it possible to remove a deployment integration even if the person whose credentials are being used for it aren’t your own. If this team member had already left the organisation we’d have been left with a permanently broken build. Also maybe make the message ‘Install Heroku API credentials’ in the console output a bit clearer as to why it’s there.