Thanks @flaco_jones for leaving the Q&A here! I can tell you that you're not the first to run into this confusion. We'll make a note to make this difference clearer in Defender.
I think I'm running in the same confusion right now.
I understand how to obtain Team API-Key and Secret.
But what is a Defender-API-KEY and Secret? After creating a Relayer, I can get an API-KEY. But where can the Secret be found? I got only an address, a API Key and a private key.
There's a lot of functionality potential in Defender, so it's understandable to have some questions about which credentials point to what component!
Defender API Key/Secret and Team API Key/Secret refer to the same thing.
A Relayer can also have its own API key/secret.
You can create a Relayer and use it via an Autotask without ever creating credentials for that Relayer. The Autotask will have the Relayer's credentials securely/automatically available to it by specifying the Relayer's ID).
If, however, you would like to send/sign transactions with a Relayer (as when deploying a contract via Relayer, for one example), you need to use the relay-client package, supplying the Relayer's key/secret.
Following the steps in the link above will illustrate the necessary steps to make this happen:
Supply your Team API key/secret to instantiate the relay-client
Send a request via the client to create a Relayer
Send a request via the client to create a key for that Relayer
Having finished those steps, you can then run ethers.js functions using the Relayer by specifying the Relayer object: