Service accounts

A service account is a user account intended for use in automated scripts. These accounts are typically used in CI/CD pipelines and integrations. A service account cannot be used to authenticate via the web interface or to perform actions through impersonation.

Creating a service account

An administrator creates instance service accounts in the web interface, through the REST API or in the Rails console. Group and project service accounts are created by the group owner and the project maintainer in the group or project settings.

In the web interface

1. Select “Admin” → “Settings” → “Service accounts”.
2. Click “Add service account”.
3. Fill in the “Name” field. The “Username” and “Email” fields are optional.
4. Click “Create”.

Through the REST API

Send a POST /api/v4/service_accounts request with an administrator token. The optional name, username, and email parameters set the name, the username, and the email address of the account.

In the Rails console

Open the Rails console for the installation type in use:

sudo gitlab-rails console

docker exec -it code gitlab-rails console

d8 k -n code exec -it deploy/code-toolbox -- gitlab-rails console -e production

d8 k -n d8-code exec -it -c toolbox deploy/toolbox -- gitlab-rails console -e production

Creating an account

1. In the Rails console, prepare the parameters defining the account to be created. Fill in the name, username, email, and admin fields, and define the rest of the parameters as shown in the example below:

   user_args = {
   name: 'kaiten_sa',
   username: 'kaiten_sa',
   email: 'kaiten_sa@flant.com',
   admin: false,
   user_type: :service_account,
   organization_id: Organizations::Organization.default_organization.id,
   password_automatically_set: true,
   force_random_password: true,
   skip_confirmation: true
   }

2. Select the user on whose behalf the service account will be created and execute the account creation:

   user = User.find_by_username('root')
   Users::CreateService.new(user, user_args).execute

Generating an access token

To create an access token in the web interface:

1. Select “Admin” → “Settings” → “Service accounts”.
2. Open the ⋮ menu in the account row and select “Manage access tokens”.
3. Click “Add new token”.
4. Fill in the “Token name” and “Expiration date” fields and select the token scopes.
5. Click “Generate token”.

To create a token through the REST API, use GitLab’s Personal access tokens API.