IAM and service accounts
See who can do what in your organisation, and give CI and automation their own service accounts with scoped, expiring keys.
Access in the sidebar opens IAM: one place to see and control who can do what in your organisation. It has five tabs: Overview, Members, Roles & policies, Service accounts and Support access.
Three ways in#
| Identity | For | Access comes from |
|---|---|---|
| Member | A person on your team | Their role, plus any policies attached to them. See Teams and roles. |
| API key | A person’s scripts and tools | Its permissions, within its creator’s organisation. See API keys. |
| Service account | CI, deployments and automation | Its scopes. It belongs to the organisation, not to a person. |
Service accounts#
A service account is an identity for automation. Because it is not tied to a person, it keeps working when someone leaves the team.
Create one#
- Open Service accounts. Go to Access → Service accounts and choose New service account.
- Name it. Use lower-case letters, digits and dashes, such as
ci-deployer. Names are unique in the organisation and cannot be changed later. Add a description if you like. - Choose scopes. Read (required) is always on. Add Create and change, Delete or Billing: wallet, plans, commitments and add-ons as the job needs.
- Choose Create service account.
Owners and admins manage service accounts. You can give a service account only what you hold yourself, so only the owner can give it billing.
Issue a key#
Choose the key count in the account’s Keys column. Choose the New key lifetime: 30 days, 90 days (the default), 1 year or No expiry (until revoked). Then choose Issue key. Copy the key when it appears; it is shown once. It starts with plx_live_ and is used exactly like an API key:
curl https://api.plexivo.io/api/v1/tenants/$TENANT/deployments \
-H "Authorization: Bearer $PLEXIVO_TOKEN"The key acts as the service account, with exactly its scopes, and with the same limits as any API key. Like every key, it can never manage people, access or other keys.
Disable, rotate or delete#
- Disable a service account to stop all of its keys at once; Enable it to bring them back. A disabled account cannot be issued new keys.
- Rotate by issuing a new key, moving your pipeline to it, then choosing Revoke on the old one. Each key shows when it was Last used.
- Delete the account and every one of its keys stops working immediately.
Custom policies#
Policies add access to individual members on top of their role, for the whole organisation. See Give extra access with policies.
Support access#
When Plexivo support or your agency needs to reveal a secret or your data to help you, they ask first. See Support and agency access.
Updated 27 October 2026