Manage API Keys

A service account is an identity that other systems use to call the Suvereo API with an API token instead of a person’s login. It is authorized in the same way as a user, through roles, granted directly or through groups. A new service account has no access until it is given roles.

Service accounts are managed under Manage → Service Accounts. The list shows each account’s name, creation date, and whether it is active and an admin.

Creating a Service Account

1. Navigate to Manage → Service Accounts and click New Service Account.
2. Enter a Name. It identifies the system that uses the account and must be unique.
3. Keep Active selected. Select Admin only if the account needs all permissions, see Admins.
4. Click Create.
5. A pop-up displays the API token of the new account. Copy it and store it in a secure location, it is shown only once.

Granting Access to a Service Account

Service accounts receive access like users do:

• On one data set: open Manage → Data Sets, click Manage Access next to the data set, select the service account and a data set role, and click Add.
• On every data set, or for system administration: grant a global role from Manage → Roles.
• Through a group: add the service account to a group that holds the roles.

For example, an integration that starts agentic executions on one data set needs a data set role on it that includes starting executions. To change what the account can do, change its roles. The account itself and its token stay as they are.

Disabling a Service Account

1. Navigate to Manage → Service Accounts and click Edit next to the account.
2. Clear Active.
3. Click Update.

The account is disabled and its API token can no longer be used. Selecting Active again enables it.

Resetting an API Token

1. Navigate to Manage → Service Accounts.
2. Click Reset Token next to the account.
3. A new token is displayed. Copy it and store it in a secure location.

The old token becomes invalid immediately.