Create service accounts and API keys

Where: Organization → API keys. The Service Accounts surface is for CI, integrations, SDKs, and other nonhuman workloads.

Service Accounts separates workload identities from their API keys and grants.

Create the identity#

1. Click Add Service Account.
2. Enter Name, for example order-report-job, and describe the purpose.
3. Click Create.
4. Inspect the account's ID and its key list.

New Service Account creates the identity before a usable key or permission grant exists.

New service accounts start with no access. Share the intended project or individual resources with that account, choosing Viewer, Editor, or Executor according to the task. A created key is not a substitute for a grant.

Create and store a key#

Use New Key for the selected account. Copy the raw key at creation into the job's secret store. It is shown only once and cannot be retrieved later. Screenshots intentionally do not include a usable raw key.

Review the key prefix, status, creation/expiry, and last-use metadata in the list. The prefix identifies a key for administration; it is not the full credential needed by a client.

Use and revoke it#

Configure the job's host, organization, project, and credential explicitly. The key is restricted to its organization and cannot manage organization settings, members, billing, or its own permissions. See CLI/MCP for the distinction between CLI service-account credentials and hosted MCP OAuth.

Choose Revoke and inspect the named prefix before confirming. Work using that key stops immediately. Deleting the service account invalidates all its keys, which is broader than rotating one key.

Verify a permitted operation and a denied operation with the job identity before running unattended work.