Skip to main content
Service accounts are machine members of your organization, used by CI to provision infrastructure. They hold an organization role like any member, cannot log in, and authenticate only through OIDC trusts. All service-account commands require the org:service-accounts scope on your organization role, and are not available in personal workspaces.

​
create

Create a service account with the given organization role:
<name> is a label you choose for the account (e.g. infra-apply).
To let an external workload (e.g. CI) authenticate as the account, attach an OIDC trust with trust create. Find role ids with synthetiq role list. The printed id is what trust create takes as --service-account-id.

​
list

List the organization’s service accounts:

​
update

Update a service account’s name or role:

​
delete

Delete a service account:
Removes the account, its membership, and all trusts attached to it. Tokens already minted expire within 15 minutes; new exchanges fail immediately. Find role IDs (for --role-id) with role list.