Manage service accounts
Create, edit, and delete Harness service accounts, and assign role bindings that API keys inherit for programmatic access.
Service accounts are similar to users in Harness, but they are not associated with a human user. You assign roles and resource groups to a service account, and then you create API keys for it. Those API keys authenticate and authorize remote services that perform operations in Harness through Harness APIs, and they inherit the role bindings assigned to the service account.
What you will learn in this topic
By the end of this topic, you will be able to:
Create a service account at any scope and assign its role bindings.
Manage API keys and tokens that inherit the service account permissions.
Edit a service account to change its name, description, tags, or role bindings.
Delete a service account that is no longer required.
Before you begin
Before you create and manage service accounts, ensure you have the following:
Harness account access: A role such as Account Admin with view, create or edit, manage, and delete permissions for service accounts.
Target scope access: Access to the scope where the service account belongs. You can create service accounts at all scopes.
RBAC familiarity: An understanding of how roles and resource groups combine into role bindings. For more information, see RBAC in Harness.
Create a service account
You can create a service account when a remote service, script, or integration needs to call Harness APIs without requiring a human user. The service account holds the role bindings, and every API key you generate under it inherits those permissions.
In Harness, navigate to the scope where you want to add the service account.
To add a service account at the account scope, select Account Settings, and then select Access Control.
To add a service account at the organization scope, navigate to Account Settings, select Organizations, select the relevant organization, and then select Access Control.
To add a service account at the project scope, navigate to Projects, select the relevant project, and then select Access Control.
Select Service Accounts in the header.
Click New Service Account.
Enter a Name and Email for the service account.
Click Save.
Select Manage Roles next to the new service account.
Click Add, and then select a role and a resource group. Repeat until you have configured all necessary role bindings for the service account.
Manage API keys
Create API keys after you create a service account, because the API keys derive their permissions from the service account. Grant the service account the necessary role bindings first, otherwise API calls made with the token fail authorization.
To generate credentials, create API keys and tokens for the service account. These tokens authenticate and authorize remote services that perform operations in Harness through Harness APIs, and they inherit the role bindings assigned to the service account.
For more information, see the API permissions reference.
Edit a service account
You can change the name, description, tags, and role bindings, but the Id and Email are fixed after creation.
In Harness, navigate to the scope where the service account exists.
To edit a service account at the account scope, select Account Settings, and then select Access Control.
To edit a service account at the organization scope, navigate to Account Settings, select Organizations, select the relevant organization, and then select Access Control.
To edit a service account at the project scope, navigate to Projects, select the relevant project, and then select Access Control.
Select Service Accounts in the header.
Locate the service account you want to edit.
Click the More icon (⋮).
Select Edit to change the Name, Description, or Tags. You cannot edit the Id or Email.
Select Edit Role Bindings to change the roles and resource groups assigned to the service account.
Delete a service account
You can delete a service account when the integration that used it is obsolete. This way, its tokens can no longer authenticate against Harness APIs. Deleting the service account invalidates the API keys and tokens created under it.
In Harness, navigate to the scope where the service account exists.
To delete a service account at the account scope, select Account Settings, and then select Access Control.
To delete a service account at the organization scope, navigate to Account Settings, select Organizations, select the relevant organization, and then select Access Control.
To delete a service account at the project scope, navigate to Projects, select the relevant project, and then select Access Control.
Select Service Accounts in the header.
Locate the service account you want to delete.
Click the More icon (⋮), and then select Delete.
FAQ
Related articles
Manage API keys: Create, rotate, and delete API keys and tokens for a service account.
Hierarchical support for service accounts: Inherit account-level service accounts in organizations and projects.
RBAC in Harness: Understand scopes, principals, roles, resource groups, and role bindings.
API permissions reference: Review the permissions available to API keys and service accounts.
Last updated
Was this helpful?