As an admin of a vault, navigate to Vault Settings → Service Accounts.
Click the Add Service Account button.
Enter the desired Name and Email values.
Add a public key
A service account is controlled by one or more RSA key pairs. When creating the
account you must add at least one key.
For each key:
- Enter a Key name so you can identify it later (for example
prod-2026or
ci-runner). Key names must be unique within the service account. - In the public key field, paste the public counterpart of the RSA key that
will control the service account.
The public key should look something like this:
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr9R9Xpo2mp1O4jHmvdn/
+Fci4brA3nO9aHr3VAPWrW6N1587JhiQMZpB17RZjWWQUvONf1QcDwYHLZOFjXGN
w2xhLOUIVswfHsUENExMiQfeXBIP5e+cNhkJMVCHT8xMAT6IIh2ex33/dwXObiOs
h49GB13Id2hOYCBdOYWpVhr5Pre3Cp2sK0DL4j6B/jkwWesx2+ercqHPLQq+HnOc
ZELKTWbecKKwXWJsyT+gIVcI9zH1h4N3gEuL1Sozw0lJ1ouPLj6WNHHXyb2CplbB
VFbRyV8fl7EvkVhw0bgcLXnYWphnreh1J0TLPI/BXKQmHrxLL1Lx84xPIAXNHHki
TL92I8XswdKoy0gmTgsQM8p7kN81XKD45T2GoMxMsJBTt/fb818cRQ4a8OB2Ii21
gcaPWc58aaYCZuO4Ibiq/ugvqtrmB+WkTeLPDDDFdHKjlmLyjRM5u4a8haigR2s9
zCdNnQgdMktUZGLqbpM1aNNCu12FTHEBF+rT4YHl97NvtAlPGRapDDxTY3S+5CXH
W/KuvtvulNiwjYEzWqUpq1fdGYirI3sblIx6/8wUYI9Gm/IlJyG7qFTJwLc7pPlm
2FaAFIu8YvGsD0Yy0aChMssGCL4w/d2wJNN41VJvNTyRv60xDGuPF9iRVXj+2adn
u+TDNpU/PNelqdqk7j6fPLMCAwEAAQ==
-----END PUBLIC KEY-----You can add more keys later.
A service account can hold up to 3 active keys at the same time. You don't
need to add them all now — you can add, rename, or remove keys at any time from
the service account's settings. Multiple keys let you rotate credentials with
zero downtime. See API Service Accounts for
details and key-rotation guidance.
Set IP Access Restrictions
Choose how the service account may be accessed. This selection is required:
- Restrict access to trusted IPs only (recommended) — the service account can
only call the Utila API from the IPs you list. Enter an address under
Whitelisted IP, and use + Add Another Whitelisted IP to add more. Each
entry is a single IPv4 or IPv6 address (CIDR ranges are not supported). - Unrestricted — the service account can be used from any IP address.
When restricting by IP, make sure to whitelist all egress IPs your
automation may use (CI runners, backend servers, NAT gateway, etc.). Requests
from any address that isn't whitelisted will be rejected.
You can change this later from the service account's settings (changes require
admin approval).
Assign Vault Role
Select the required role within the vault, or skip for now.
This action will trigger a vault action which may require an approval from additional vault admins.
