new
Enterprise
Signature
Access & Security
Workspace: Service Accounts
Integrations no longer have to run on a person's login. Service accounts are workspace-owned identities with their own scoped, rotatable credentials, created and managed by Administrators in Workspace Administration.
Key Highlights
- Workspace-Owned Identity: A service account belongs to the workspace rather than an employee, so an integration keeps running through role changes and departures, and it does not consume a paid seat or allow interface sign-in.
- Least-Privilege Access: Grant each account only the solutions, tables and scopes it needs, chosen one at a time, instead of inheriting whatever its creator happens to have.
- Named, Revocable Credentials: Generate a key with a name you will recognize in logs, copy the full value the one time it is shown, and revoke it on its own without disturbing the account's other keys.
- Rotation Built In: Set a client secret expiration and a rotation policy, see the resolved expiry date on the account, and rotate with overlap so integrations keep working at cutover.
- Access Reviews: Every account carries a named owner, a backup owner, its authentication method, its granted scopes and its last-used date, so a quarterly review can cover non-human identities with the same evidence you collect for people.
- Contained Blast Radius: Rate limits, usage alerts and allowed IP ranges bound what a credential can do even if it is exposed.
How It Works
- Open Service Accounts under Workspace Administration to see every account with its authentication method, status and last use, filterable and searchable by name.
- Create an account through a guided flow with four steps: Details, Authentication, Security and Access.
- In Details, name the account, describe what it is for, and assign a named owner and a backup owner who takes over if the owner is deactivated.
- In Authentication, choose OAuth 2.0 for production system-to-system integrations or an API token for simple scripts, then set the client secret expiration and rotation policy.
- In Security, set rate limits, usage alerts and any allowed IP ranges that the account's credentials are restricted to.
- In Access, add the solutions and tables the account may reach and pick a scope for each one, such as reading or writing records.
- Generate a key when you are ready, copy it straight into your secrets manager, and revoke or rotate it later from the account's Keys section.
- Disable an account from its status toggle to cut off access immediately without losing its configuration.
Non-human identities are now governed the way people are: owned, scoped, time-bound and reviewable.