Skip to main content
Manage a project’s service accounts.
A service account is a non-human account that a project owns. Grant it access to repositories, then let your jobs and agents sign in as it with an OIDC token or a secret. See Service Accounts for the full setup. entire sa is short for entire service-account. Commands name a service account by its svc_ ID or as PROJECT/NAME, such as acme/deploy.

​
entire service-account create

Create a service account in a project. You need permission to manage the Entire project.
Names are unique within a project. An organization or account can have up to 5 service accounts across all its projects.

​
entire service-account list

List a project’s service accounts.

​
entire service-account get

Show a service account.

​
entire service-account delete

Delete a service account with its grants, bindings, and secrets. Jobs that sign in as it stop working.

​
entire service-account grant

Grant a service account a role on one repository or on its own project.
The repository or project must belong to the service account’s project. Granting again changes the role.

​
entire service-account grants

List the repository and project grants a service account holds. Only grants you can manage are shown.

​
entire service-account revoke

Remove a service account’s grant on a repository or project.

​
entire service-account providers

List the OIDC platforms you can bind a service account to. Name one to see the pins a binding can set, which ones are required, and the platform’s setup guide.

​
entire service-account bind

Let a platform’s jobs and agents sign in as a service account with their OIDC tokens. Each --pin narrows which tokens match.
A terminal asks for any required pin you leave out. A service account holds one binding per platform. A pin matches a name, so unbind before you rename or delete a bound repository or pipeline. See OpenID Connect (OIDC) for each platform’s pins.

​
entire service-account bindings

List a service account’s bindings.

​
entire service-account unbind

Remove a binding, so the platform’s jobs can no longer sign in as the service account. Removing a binding that doesn’t exist succeeds. Tokens already issued keep working for up to 45 minutes after you remove a binding. To cut access sooner, revoke the service account’s grants.

​
entire service-account secret create

Create a secret for a service account and print it once. You need permission to manage the Entire project to create a secret.
Only the secret goes to stdout, so you can redirect it into a file or a secret store. A secret lasts 90 days by default. A service account holds at most two unexpired secrets, so you can create a new one before you delete the old one.

​
entire service-account secret list

List a service account’s unexpired secrets, and those that expired in the last 30 days, with when and from which client each was last used. The secrets themselves are never shown again.

​
entire service-account secret delete

Delete a secret, so it can no longer be exchanged. Tokens already exchanged from it keep working until they expire, at most 10 minutes. Deleting a secret that doesn’t exist succeeds.

​
Continue With

Service Accounts

Create a service account, grant it access, and sign in with a secret.

OpenID Connect (OIDC)

Let your jobs and agents sign in with their platform’s token.