Service Accounts for APIs in Multi-Tenant Portal

Previously, API access was tied to individual Admin accounts, requiring either the creation of dedicated Admin accounts for integrations or the use of Admins’ personal API keys.

This approach presented several issues like increased number of Admin accounts and single points of failure. For example, if an Admin left the org or if their account was disabled, all the dependent integrations would fail and be disruptive.

In the multi-tenant portal, JumpCloud lets you create Service Accounts that are not tied to individual Admin accounts. These can be created in the Accounts tab. Anyone having access to the Service Accounts scope permission can generate and manage keys for specific use cases without creating more Admin accounts which significantly improves security, maintenance, and reliability of our integrations.

Why Use a Service Account?

Service Accounts are the digital IDs for your applications, letting you automate workflows securely and at scale. They replace risky, hardcoded credentials with a manageable, auditable, and least-privilege approach to access control, drastically reducing your attack surface.

Here are a few reasons why you should use a Service Account instead of an Admin Account linked with API keys.

Non-Human Identity

A Service Account is a non-human identity used by automated systems (scripts, services, or CI/CD pipelines) to authenticate and interact with APIs or systems without user intervention.

Token-Based Access (Client ID + Client Secret)

The Service Account uses client credentials (Client ID and Client Secret) to request an access token via an OAuth 2.0 token endpoint. This token is then used to make authenticated API calls as part of a workflow.

Role-Based Access Control (RBAC)

The Service Account is granted specific permissions or scopes to perform only certain actions (for example: creating users, triggering provisioning, or fetching device data). These roles ensure the Service Account has just enough access needed by the workflow.

Trigger Points for Automation

Workflow automation tools (like Zapier, Jenkins, GitHub Actions, or internal schedulers) use the Service Account credentials to:

• Trigger actions on schedule
• Respond to events (webhooks, cron jobs)
• Poll APIs regularly
• Handle error retries or escalations

Adding a Service Account

To add a Service Account:

1. Log into the JumpCloud MTP.
2. In the Accounts tab, go to Service Accounts.
3. Click +New to add a new Service Account.

note

Only an Administrator with billing can create and link a Service Account to a JumpCloud role. An Administrator role can only view the Service Account details.

4. Enter the Name of the account, then select a Role from the dropdown menu. Enter the Description.
5. Under Organization Access, select the Orgs for which you want to use this service account. Click Apply once done.

note

New orgs do not automatically inherit the existing service accounts. An Admin must assign them manually.

6. Under Key Type, select the Client Secret radio button. A pop-up for setting the expiration date appears. Set an expiration date for the Service Account by selecting a date from the Secret Lifetime dropdown menu
7. Click Activate. The Client ID and Client Secret are displayed. These are only displayed at the time they’re created. Make sure to store it in a secure place so you can access it when you need it. Click Close.

The new Service Account will appear under the Service Accounts tab under Account. An Admin with billing role can create multiple Service Accounts. Each Service Account will have 2 Client Secrets. In case one Client Secret is about to expire, the org can leverage the other one. The Admin will receive an email 7 days prior to the expiration date.

Click the Add item button on right to add one more client secret as required.

Deleting Client Secrets

To delete a client secret:

1. Click the Delete button next to the client secret. A pop-up appears prompting you to confirm the deletion.
2. Click Delete.
   The Client Secret should no longer be listed.

warning

If you delete a Client Secret, you’ll no longer be able to interact with JumpCloud APIs using that Client Secret.

Deleting a Service Account

To delete a Service Account:

1. Select the Service Account you want to delete.
2. Click the Delete Account button in the upper right corner. A pop-up appears prompting you to confirm the deletion.
3. Enter the Service Account name and click Delete.
   The Service Account should no longer be listed.