Skip to main content

Manage service accounts

Last updated on

Service accounts are similar to users in Harness, but they are not associated with a human user. You assign roles and resource groups to a service account, and then you create API keys for it. Those API keys authenticate and authorize remote services that perform operations in Harness through Harness APIs, and they inherit the role bindings assigned to the service account.

What will you learn in this topic?​

By the end of this topic, you will be able to:

Before you begin​

Before you create and manage service accounts, ensure you have the following:

  • Harness account access: A role such as Account Admin with view, create or edit, manage, and delete permissions for service accounts.
  • Target scope access: Access to the scope where the service account belongs. You can create service accounts at all scopes.
  • RBAC familiarity: An understanding of how roles and resource groups combine into role bindings. For more information, see RBAC in Harness.

Create a service account​

You can create a service account when a remote service, script, or integration needs to call Harness APIs without requiring a human user. The service account holds the role bindings, and every API key you generate under it inherits those permissions.

  1. In Harness, navigate to the scope where you want to add the service account.

    • To add a service account at the account scope, select Account Settings, and then select Access Control.
    • To add a service account at the organization scope, navigate to Account Settings, select Organizations, select the relevant organization, and then select Access Control.
    • To add a service account at the project scope, navigate to Projects, select the relevant project, and then select Access Control.

  2. Select Service Accounts in the header.

  3. Click New Service Account.

  4. Enter a Name and Email for the service account.

  5. Click Save.

  6. Select Manage Roles next to the new service account.

  7. Click Add, and then select a role and a resource group. Repeat until you have configured all necessary role bindings for the service account.

Manage API keys​

Create API keys after you create a service account, because the API keys derive their permissions from the service account. Grant the service account the necessary role bindings first, otherwise API calls made with the token fail authorization.

To generate credentials, create API keys and tokens for the service account. These tokens authenticate and authorize remote services that perform operations in Harness through Harness APIs, and they inherit the role bindings assigned to the service account.

For more information, see the API permissions reference.

Edit a service account​

You can change the name, description, tags, and role bindings, but the Id and Email are fixed after creation.

  1. In Harness, navigate to the scope where the service account exists.

    • To edit a service account at the account scope, select Account Settings, and then select Access Control.
    • To edit a service account at the organization scope, navigate to Account Settings, select Organizations, select the relevant organization, and then select Access Control.
    • To edit a service account at the project scope, navigate to Projects, select the relevant project, and then select Access Control.

  2. Select Service Accounts in the header.

  3. Locate the service account you want to edit.

  4. Click the More icon (⋮).

  5. Select Edit to change the Name, Description, or Tags. You cannot edit the Id or Email.

  6. Select Edit Role Bindings to change the roles and resource groups assigned to the service account.

Delete a service account​

You can delete a service account when the integration that used it is obsolete. This way, its tokens can no longer authenticate against Harness APIs. Deleting the service account invalidates the API keys and tokens created under it.

  1. In Harness, navigate to the scope where the service account exists.

    • To delete a service account at the account scope, select Account Settings, and then select Access Control.
    • To delete a service account at the organization scope, navigate to Account Settings, select Organizations, select the relevant organization, and then select Access Control.
    • To delete a service account at the project scope, navigate to Projects, select the relevant project, and then select Access Control.

  2. Select Service Accounts in the header.

  3. Locate the service account you want to delete.

  4. Click the More icon (⋮), and then select Delete.

FAQ​

Can a service account created at the project scope be assigned permissions to access an account-level resource?

No. A service account created at the project scope cannot be granted access to account-level resources. Instead, create an account-level service account and then provide project-level role bindings for it that correspond to the project. You can also provide role bindings for account-level templates.

How long is a service account token valid?

The validity depends on how you create the token. If you specify an expiry date, the token expires on that date. If you want the token to never expire, select the No Expiration option.

Can you identify which service account a token belongs to by looking at the token?

No. There is no way to determine the associated service account from a service account token such as sat.w8EaJoerQcqqkZwcb... by inspecting the token itself.

How do service account tokens differ from personal access tokens?

Personal access tokens are created at the user profile level and are prefixed with pat., while service account tokens are created at the service account level and are prefixed with sat.. Harness does not assign permissions directly to tokens. A token inherits permissions from the user or the service account under which it was created.