> ## Documentation Index
> Fetch the complete documentation index at: https://docs.entire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# service-account

> Manage a project's service accounts.

Manage a project's service accounts.

```bash theme={null}
entire service-account COMMAND
```

A service account is a non-human account that a project owns. Grant it access to repositories, then let your jobs and agents sign in as it with an [OIDC token](https://docs.entire.com/guides/configuration/oidc.md) or a [secret](https://docs.entire.com/guides/configuration/service-accounts.md#sign-in-with-a-secret). See [Service Accounts](https://docs.entire.com/guides/configuration/service-accounts.md) for the full setup.

`entire sa` is short for `entire service-account`. Commands name a service account by its `svc_` ID or as `PROJECT/NAME`, such as `acme/deploy`.

## `entire service-account create`

Create a service account in a project. You need permission to manage the Entire project.

```bash theme={null}
entire service-account create PROJECT NAME [flags]
```

Names are unique within a project. An organization or account can have up to 5 service accounts across all its projects.

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

```bash theme={null}
entire service-account create acme deploy
```

## `entire service-account list`

List a project's service accounts.

```bash theme={null}
entire service-account list PROJECT [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

## `entire service-account get`

Show a service account.

```bash theme={null}
entire service-account get SERVICE_ACCOUNT [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

## `entire service-account delete`

Delete a service account with its grants, bindings, and secrets. Jobs that sign in as it stop working.

```bash theme={null}
entire service-account delete SERVICE_ACCOUNT [flags]
```

| Flag | Description |
| - | - |
| `-f, --force` | Skip the confirmation prompt. |
| `-y, --yes` | Skip the confirmation prompt. Alias for `--force`. |

## `entire service-account grant`

Grant a service account a role on one repository or on its own project.

```bash theme={null}
entire service-account grant SERVICE_ACCOUNT (--repo REPO | --project PROJECT) --role ROLE
```

The repository or project must belong to the service account's project. Granting again changes the role.

| Flag | Description |
| - | - |
| `--project PROJECT` | The service account's own project, by name or ULID. Grants every repository in it. |
| `--repo REPO` | A repository in the service account's project, by name or as `/et/PROJECT/REPO`. |
| `--role ROLE` | `reader`, `writer`, or `admin`. Required. |

```bash theme={null}
entire service-account grant acme/deploy --repo web --role writer
entire service-account grant acme/deploy --project acme --role reader
```

## `entire service-account grants`

List the repository and project grants a service account holds. Only grants you can manage are shown.

```bash theme={null}
entire service-account grants SERVICE_ACCOUNT [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

## `entire service-account revoke`

Remove a service account's grant on a repository or project.

```bash theme={null}
entire service-account revoke SERVICE_ACCOUNT (--repo REPO | --project PROJECT)
```

| Flag | Description |
| - | - |
| `--project PROJECT` | The service account's own project, by name or ULID. |
| `--repo REPO` | A repository in the service account's project, by name or as `/et/PROJECT/REPO`. |

```bash theme={null}
entire service-account revoke acme/deploy --repo web
```

## `entire service-account providers`

List the OIDC platforms you can bind a service account to. Name one to see the pins a binding can set, which ones are required, and the platform's setup guide.

```bash theme={null}
entire service-account providers [NAME] [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

```bash theme={null}
entire service-account providers
entire service-account providers buildkite
```

## `entire service-account bind`

Let a platform's jobs and agents sign in as a service account with their OIDC tokens. Each `--pin` narrows which tokens match.

```bash theme={null}
entire service-account bind SERVICE_ACCOUNT --provider NAME --pin NAME=VALUE... [flags]
```

A terminal asks for any required pin you leave out. A service account holds one binding per platform. A pin matches a name, so unbind before you rename or delete a bound repository or pipeline. See [OpenID Connect (OIDC)](https://docs.entire.com/guides/configuration/oidc.md) for each platform's pins.

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |
| `--pin NAME=VALUE` | A token attribute to match. Repeat for each pin. |
| `--provider NAME` | The platform, such as `github-actions` or `buildkite`. Required. |

```bash theme={null}
entire service-account bind acme/deploy --provider github-actions --pin repository=acme/web
entire service-account bind acme/deploy --provider buildkite --pin organization=acme --pin pipeline=deploy
```

## `entire service-account bindings`

List a service account's bindings.

```bash theme={null}
entire service-account bindings SERVICE_ACCOUNT [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

## `entire service-account unbind`

Remove a binding, so the platform's jobs can no longer sign in as the service account. Removing a binding that doesn't exist succeeds. Tokens already issued keep working for up to 45 minutes after you remove a binding. To cut access sooner, revoke the service account's grants.

```bash theme={null}
entire service-account unbind SERVICE_ACCOUNT BINDING_ID
```

```bash theme={null}
entire service-account unbind acme/deploy eib_01HZX7QABCDEFGHJKMNPQRSTVW
```

## `entire service-account secret create`

Create a secret for a service account and print it once. You need permission to manage the Entire project to create a secret.

```bash theme={null}
entire service-account secret create SERVICE_ACCOUNT [flags]
```

Only the secret goes to stdout, so you can redirect it into a file or a secret store. A secret lasts 90 days by default. A service account holds at most two unexpired secrets, so you can create a new one before you delete the old one.

| Flag | Description |
| - | - |
| `--expires-in-days DAYS` | Lifetime in days, 1 to 365. Defaults to 90. |
| `--json` | Output raw JSON instead of the secret alone. |

```bash theme={null}
entire service-account secret create acme/deploy > deploy.secret
entire service-account secret create acme/deploy --expires-in-days 30
```

## `entire service-account secret list`

List a service account's unexpired secrets, and those that expired in the last 30 days, with when and from which client each was last used. The secrets themselves are never shown again.

```bash theme={null}
entire service-account secret list SERVICE_ACCOUNT [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

## `entire service-account secret delete`

Delete a secret, so it can no longer be exchanged. Tokens already exchanged from it keep working until they expire, at most 10 minutes. Deleting a secret that doesn't exist succeeds.

```bash theme={null}
entire service-account secret delete SERVICE_ACCOUNT SECRET_ID
```

```bash theme={null}
entire service-account secret delete acme/deploy sas_01HZX7QABCDEFGHJKMNPQRSTVW
```

## Continue With

> [card] [Service Accounts](https://docs.entire.com/guides/configuration/service-accounts.md)
>
> Create a service account, grant it access, and sign in with a secret.

> [card] [OpenID Connect (OIDC)](https://docs.entire.com/guides/configuration/oidc.md)
>
> Let your jobs and agents sign in with their platform's token.