Service accounts
Scoped, non-user accounts for automation and server-to-server access
A service account is a non-user identity for CI, servers, and other automation that calls the Stashbase API. Grant it only the projects, environments, and permissions it needs, and authenticate with its API keys.
Required roles
To manage (view, create, update, delete) service accounts, you must have Owner or Admin role in the workspace.
Creating a service account
To create a service account, you can navigate to the Stashbase dashboard then to service accounts (settings) and there you can click on the Create new button.
Each service account has unique ID, unique name and optional description.
Access
Service account can have associated workspace-level access permissions (like projects.read or projects.write) and specific project-level access permissions (like environment.read or secrets.write). You can grant access to individual projects and resources within the projects (like environments, secrets, webhooks, etc.).
IP Allowlist
To restrict access using the service API Keys, you can define a list of IP addresses that are allowed to use the service account (authenticate using the service API Key).
IP addresses must be in CIDR notation, using either IPv4 or IPv6 format. You can also use 0.0.0.0/0 or ::/0 to allow all IP addresses.
If there are no IPs defined in the allowlist, the request using the service API Key will be accepted from any IP address.
API Keys
To authenticate using the service account, you can generate an API Key. API Key is a string of characters that uniquely identifies the service account and is used to authenticate requests to the Stashbase API.
To generate an API Key, you can navigate to the service account details page, then to the API Keys tab and click on the Create new button.
You can also set expiration date for the API Key so it will be automatically revoked on the specified date.
Each API key can be revoked at any time, which will immediately invalidate the key and prevent any further use. API key can be also temporarily disabled and later re-enabled if needed.