---
updatedAt: 2026-07-23T12:55:49.000Z
agentTools:
  projectIndex: https://docs.utila.io/llms.txt
---

# Creating a Service Account

As an admin of a vault, navigate to [**Vault Settings** → **Service Accounts**](https://console.utila.io/settings/service-accounts).

Click the *Add Service Account* button.

![](https://files.readme.io/53d7c78a72e7c774536cf1e4caaab59d1b994c3efb5c5a4a6483e8476414085f-image.png)

Enter the desired **Name** and **Email** values.

## Add a public key

A service account is controlled by one or more RSA key pairs. When creating the
account you must add **at least one** key.

For each key:

1. Enter a **Key name** so you can identify it later (for example `prod-2026` or
   `ci-runner`). Key names must be unique within the service account.
2. In the **public key** field, paste the public counterpart of the RSA key that<br />will control the service account.

The public key should look something like this:

```
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr9R9Xpo2mp1O4jHmvdn/
+Fci4brA3nO9aHr3VAPWrW6N1587JhiQMZpB17RZjWWQUvONf1QcDwYHLZOFjXGN
w2xhLOUIVswfHsUENExMiQfeXBIP5e+cNhkJMVCHT8xMAT6IIh2ex33/dwXObiOs
h49GB13Id2hOYCBdOYWpVhr5Pre3Cp2sK0DL4j6B/jkwWesx2+ercqHPLQq+HnOc
ZELKTWbecKKwXWJsyT+gIVcI9zH1h4N3gEuL1Sozw0lJ1ouPLj6WNHHXyb2CplbB
VFbRyV8fl7EvkVhw0bgcLXnYWphnreh1J0TLPI/BXKQmHrxLL1Lx84xPIAXNHHki
TL92I8XswdKoy0gmTgsQM8p7kN81XKD45T2GoMxMsJBTt/fb818cRQ4a8OB2Ii21
gcaPWc58aaYCZuO4Ibiq/ugvqtrmB+WkTeLPDDDFdHKjlmLyjRM5u4a8haigR2s9
zCdNnQgdMktUZGLqbpM1aNNCu12FTHEBF+rT4YHl97NvtAlPGRapDDxTY3S+5CXH
W/KuvtvulNiwjYEzWqUpq1fdGYirI3sblIx6/8wUYI9Gm/IlJyG7qFTJwLc7pPlm
2FaAFIu8YvGsD0Yy0aChMssGCL4w/d2wJNN41VJvNTyRv60xDGuPF9iRVXj+2adn
u+TDNpU/PNelqdqk7j6fPLMCAwEAAQ==
-----END PUBLIC KEY-----
```

<Callout icon="📘" theme="info">
  **You can add more keys later.**<br />A service account can hold up to **3 active keys** at the same time. You don't<br />need to add them all now — you can add, rename, or remove keys at any time from<br />the service account's settings. Multiple keys let you rotate credentials with<br />zero downtime. See [API Service Accounts](https://docs.utila.io/reference/service-accounts) for<br />details and key-rotation guidance.
</Callout>

## Set IP Access Restrictions

Choose how the service account may be accessed. This selection is required:

* **Restrict access to trusted IPs only (recommended)** — the service account can
  only call the Utila API from the IPs you list. Enter an address under
  **Whitelisted IP**, and use **+ Add Another Whitelisted IP** to add more. Each
  entry is a single IPv4 or IPv6 address (CIDR ranges are not supported).
* **Unrestricted** — the service account can be used from any IP address.

<Callout icon="📘" theme="info">
  When restricting by IP, make sure to whitelist **all** egress IPs your
  automation may use (CI runners, backend servers, NAT gateway, etc.). Requests
  from any address that isn't whitelisted will be rejected.
  You can change this later from the service account's settings (changes require
  admin approval).
</Callout>

# Assign Vault Role

Select the required role within the vault, or skip for now.

This action will trigger a *vault action* which may require an approval from additional vault admins.

<Image src="https://files.readme.io/809cf02f597927b894455272691b32aeb50eb06a87726730bb377b721a8972cc-image.png" align="center" width="50% " border={true} />

<br />