Skip to main content
A service account is a named identity for an integration. It owns API keys or OAuth clients and carries the permissions those credentials may use, so access review happens at the account level: what an integration can do is visible in one place, regardless of how many credentials it holds. The account itself is not a credential: its ID cannot authenticate a request. See Authentication to choose a method; an API-key integration does not need OAuth. Manage service accounts from the Service accounts tab of the Developer Hub.

​
Design your accounts around workloads

Create one service account per integration or workload — for example reporting-pipeline, scim-sync, or soc-enrichment — rather than one broad account for everything. Per-workload accounts keep permissions minimal, make request logs attributable, and let you disable one integration without touching the others.

​
Create a service account

1

Name the account

Give the account a name that identifies the workload it serves, and a description of what it does. Both appear in lists and logs, so future admins can tell accounts apart.
2

Grant permissions

Select the permissions the account may grant to its credentials — for example entity:read, simulation:read, or reporting:read. This set is the ceiling for every credential created under the account: a credential can carry a subset of these permissions, never more.
Grant the minimum the workload needs today. You can add account permissions later; existing credentials keep their granted scopes.
3

Review and create

Confirm the name and permission set. After creation, the account’s detail page is where you create its API keys.

​
Manage the lifecycle

  • Edit permissions at any time. Removing a permission from the account removes it from what its API keys and OAuth access tokens can exercise.
  • Disable an account to stop API access through all its credentials — useful when offboarding an integration or containing a suspected credential leak while you investigate. Re-enabling allows credentials that are still active and unexpired to authenticate again.
  • Delete an account when the integration has been retired. Stop the integration and revoke its credentials first. Deletion is permanent.
Each account’s detail page shows who created it, when, and when one of its keys was last used — a quick way to spot abandoned integrations that should be disabled.