Skip to main content

​
Create a service account

For production systems, CI runners, backend services, and scheduled jobs, use a service account instead of a person’s credentials. A service account is a non-human machine identity you attach to one or more teams, and mint API keys for. You can create one by navigating to Access → Service accounts and clicking New service account in the top right corner. Because keys inherit the team scope, detaching a service account from a team (or deleting it) immediately stops every key minted for it on that team, giving you a clean kill switch for production credentials.

​
Create its API key

Follow API keys and select the service account as the principal. Choose the team and permissions needed by the application.

​
Access lifecycle

Review team membership and key permissions when an application changes ownership. Before replacing a credential, identify the workloads using it and update those workloads before retiring the old key.