Service accounts

A service account is how something that is not a person signs in: a warehouse sync, a shop connector, a script. It authenticates with an API key instead of a password, and holds roles exactly as a member does.

Only the workspace owner can issue one.

Issue a key

1. Open settings from the workspace name in the sidebar, then Service accounts.

2. Choose Create service account and name it after the integration that will use it — Warehouse sync, not key 2.

3. Add the roles it needs. Give it the narrowest set that does its job; a key that can only read stock cannot release an invoice.

4. Choose Create. The API key is shown once.

5. Copy the key into the integration now. It is never shown again.

The key is shown exactly once

Leaving the dialog without copying it means revoking the account and issuing a new one. There is no way to read an existing key back.

Managing them

The list shows each account’s roles, when it was Created, and when it was Last used — which is how an integration nobody remembers gets found.

Editing an account changes its name and its roles. It does not reissue the key.

Revoke stops the key working immediately, and every integration using it stops with it. Revocation cannot be undone; a replacement is a new account with a new key.

Good practice

• One account per integration, never one shared key.
• Roles narrowed to the job, reviewed when the integration changes.
• Revoke rather than edit when a key may have leaked.