Service Accounts

A service account is a machine identity owned by the organization. Use one for CI, scripts, and integrations instead of running automation as a person.

Because the organization owns the identity, its credentials can keep working when the person who created it leaves. An organization admin can disable the service account without changing anyone's personal account.

Open Service Accounts in the organization sidebar and select New service account. Provide:

• Name: a clear identity such as CI deploy.
• What it's used for: an optional explanation of the workload or owner.
• Organization role: Member or Manager. Service accounts cannot be organization admins.

Select Create, then select Manage on the new account to issue credentials and grant project access.

In Manage service account, choose a project and assign Viewer, Editor, or Admin. Grant access only to the projects and actions the automation needs.

You can review and revoke the account's project roles from the same dialog.

Under Credentials:

1. Enter a name, such as github-actions.
2. Set the credential lifetime in days.
3. Select Issue.
4. Copy the credential immediately. Reflex will not show it again.
5. Send it in the X-API-Token header from your CI job, script, or integration.

The credential list shows names, creation dates, and expiration dates. Revoke a credential when it is no longer used or may have been exposed.

Disabling a service account revokes all of its credentials and removes its organization access. Its project-role assignments are kept, so you can restore the setup later, but you must issue new credentials after enabling it.

Deleting a service account permanently revokes its credentials and project roles.

• Start with the Member organization role unless the automation must create projects.
• Keep the description current so admins know the workload and human owner.
• Rotate credentials and remove unused project access regularly.
• Use audit logs to review activity.
• Use a personal account for interactive work; do not share personal credentials with automation.

• Roles & permissions — choose organization and project roles.
• Provisioning — manage human membership through SCIM.
• Automated provisioning — use a service account to drive directory-based onboarding.