ContextQMD
Back to Reflex

Service Accounts

docs/ai_builder/organization/service_accounts.md

0.9.8a13.0 KB
Original Source

Service Accounts

A service account is a machine identity owned by the organization. Use one for CI, scripts, and integrations instead of running automation as a person.

Because the organization owns the identity, its credentials can keep working when the person who created it leaves. An organization admin can disable the service account without changing anyone's personal account.

md
# Plan availability
Service accounts are available on supported plans and only to organization admins. If you are not an admin, ask one to create or manage the account. If an admin cannot see the creation control, [contact sales](https://reflex.dev/pricing/) to confirm plan availability.

Create a service account

Open Service Accounts in the organization sidebar and select New service account. Provide:

  • Name: a clear identity such as CI deploy.
  • What it's used for: an optional explanation of the workload or owner.
  • Organization role: Member or Manager. Service accounts cannot be organization admins.

Select Create, then select Manage on the new account to issue credentials and grant project access.

Grant project access

In Manage service account, choose a project and assign Viewer, Editor, or Admin. Grant access only to the projects and actions the automation needs.

You can review and revoke the account's project roles from the same dialog.

Issue a credential

Under Credentials:

  1. Enter a name, such as github-actions.
  2. Set the credential lifetime in days.
  3. Select Issue.
  4. Copy the credential immediately. Reflex will not show it again.
  5. Send it in the X-API-Token header from your CI job, script, or integration.

The credential list shows names, creation dates, and expiration dates. Revoke a credential when it is no longer used or may have been exposed.

md
# Service-account credentials are secrets
Store credentials in the workload's secret manager. Do not paste them into source code, Builder prompts or knowledge, logs, screenshots, or documentation.

Disable or delete an account

Disabling a service account revokes all of its credentials and removes its organization access. Its project-role assignments are kept, so you can restore the setup later, but you must issue new credentials after enabling it.

Deleting a service account permanently revokes its credentials and project roles.

Keep access safe

  • Start with the Member organization role unless the automation must create projects.
  • Keep the description current so admins know the workload and human owner.
  • Rotate credentials and remove unused project access regularly.
  • Use audit logs to review activity.
  • Use a personal account for interactive work; do not share personal credentials with automation.