Overview
Collaborator Service Accounts (CSAs) let you automate access to specific LucidLink folders and filespaces without handing out full administrator credentials. Each CSA is scoped to only the read and/or write permissions you explicitly grant it, on only the paths you choose, so a script, CI pipeline, or integration only ever has as much access as its job requires.
This beta is available on all plans, including Trial. Collaborator Service Accounts in this beta release are created and managed entirely through the API, SDK, or MCP.
Creating and Using a Collaborator Service Account
-
Create the Collaborator Service Account. To create a CSA, call the same endpoint authenticated with an Admin Service Account's token, the same way CSA creation has always worked.
Important note: The key is only shown once, at creation. Store it securely, it can't be retrieved again.
Grant filespace or folder permissions: Assign read and/or write access to a specific path.
Use the Collaborator Service Account's own ID here, not the ID of its key, using the key ID by mistake returns a "no principal found" error.Use the key: Mount the filespace with the LucidLink client using the key, or use it to authenticate your integration.
Rotate or manage keys as needed: See the Service Accounts article for step-by-step key rotation guidance.
Frequently Asked Questions
Who can create a Collaborator Service Account? Workspace members can create Collaborator Service Accounts using an existing Admin Service Account's token, the same way this has always worked. Both paths are available in this beta.
What can a new Collaborator Service Account access by default? Nothing. Every CSA starts with zero filespace access, you must grant permissions explicitly before it can read or write anything.
Can one Collaborator Service Account access more than one filespace or folder? Yes. You can grant it multiple permissions across different filespaces and folders, each scoped independently, for example, read-only on one folder and read/write on another.