Skip to main content

​
Overview

A service account is a non-human identity for CI and integrations. Tokens start with shipd_sa_, are shown once, and can be scoped, bound to a project/environment, expired, and revoked. Prefer this over a personal management key (shipd_mgmt_) for GitHub Actions and other integrations.

​
Steps

1

Create the account

Dashboard → Settings → Service accounts → Create service account. Name it after the job, e.g. github-actions.
2

Mint a token

Open the account. Create token. Pick the smallest scopes the job needs. Every shipd push needs flag:update; add flag:create for additions, flag:archive with --prune, flag_state:update for non-production default-only changes, and flag_production:toggle for production, definition changes, or additions. Bind it to web-app at the project level when the job creates or changes flag definitions. Environment-bound tokens are for environment-only reads and state operations. Optionally set an expiry.
3

Use it in CI

If the token is org-wide (no project/environment binding), --project and --env are required.
Disable the account to invalidate every token at once. Revoke a single token when one pipeline is compromised. An approval policy may accept a default change but queue it for review. The CLI returns exit code 5 and reports the queued request instead of claiming that change is live. See Review production changes. Related: Service account tokens · Sync flags in CI · SDK keys, management API keys, and service account tokens.