Service accounts

A service account is a non-human identity in your organization. It represents a machine, a CI workflow, or a coding agent.

A service account is assigned a set of permissions that define which API actions the service account's access tokens can take.

Service accounts can be managed here.

Permissions

A service account is assigned its permissions directly, and every access token it issues inherits them. Editing the account's permissions changes what its existing tokens can do, so you can widen or narrow an account without rotating its credentials.

Only an organization member holding a permission can grant it to a service account, and the same goes for taking one away.

A service account can also join a group. It then holds what the group grants in addition to the permissions you assign it directly.

Access tokens

A service account can have multiple access tokens, which is helpful for rotating credentials. These credentials will default to a date-based name, but you can also give them more helpful names to describe where you intend to use them, for example.

RWX shows the token once, right after you create it. It starts with rwx_org_. Store it somewhere safe; it can't be shown again.

Expiration

You can give a token an optional expiration date when you create it. Choose 30, 60, or 90 days, a custom date, or no expiration.

Revoking a token

Revoke a token from the service account's page. Revocation is immediate and permanent; issue a new token to replace it.

Assuming a service account in a task

A task can read an access token for a service account through a vault. RWX creates the token when the task runs and revokes it when the task finishes, to prevent the need to store a long-lived token in a secret.

You can attach a service account to a vault from the vault's "Service Accounts" tab.

Then read the token in an expression. When attaching the service account to the vault, you'll see an expression you can copy into your run definitions, as shown below.

tasks:
  - key: deploy
    run: ./deploy
    env:
      RWX_ACCESS_TOKEN: ${{ vaults.production.service-accounts.deploy-bot.token }}

The token holds every permission the service account holds, including the permissions its groups grant. RWX treats the token as sensitive, so it scrubs the token from logs.

If you detach the service account from the vault, the token will immediately be revoked.

Deactivating a service account

Deactivating an account revokes all of its tokens and removes it from the list. Anything still using one of those tokens starts failing to authenticate, so confirm nothing depends on it first.

A vault keeps a deactivated account attached and shows it as deactivated, and a task that reads the token after the account is deactivated will fail.