Collaborator Service Accounts (GA)

  • Updated

Overview

Collaborator Service Accounts (CSAs) let scripts, pipelines and integrations access specific LucidLink folders without administrator credentials. You create a CSA in the web app, choose the filespaces and folders it can reach, and manage its keys. A CSA only ever has the read and write access you grant it.

Collaborator Service Accounts are available on all plans.

Frequently asked questions

Who can create and manage Collaborator Service Accounts? 
Workspace owners and admins. Filespace admins can't create or manage them. You can see every CSA in your workspace, including ones other admins created.

What can a new Collaborator Service Account access? 
Nothing. Grant access after you create it. You can grant access to several filespaces and folders, each with its own read or write permission.

Can a key have narrower access than its Collaborator Service Account? 
No. Every key inherits the access of its CSA.

Do keys expire? 
Yes. When you create a key, it expires after 90 days by default. You can change the expiration during creation.

Can I create single-use keys in the web app? 
No. Single-use keys are available only through the API and MCP.

Does a Collaborator Service Account get the permissions of the Everyone group? 
No. CSAs aren't members of the Everyone group. Grant access directly to each CSA.

Creating and managing a collaborator service account

  1. Open the service accounts page: Go to the service accounts page, select Create a service account, and choose Collaborator service account. 
    image-20261027-150619.png

  2. Choose access: Go to the Access tab and choose Manage access. Select the filespaces and folders the CSA can use, and set read or write for each. Write includes read. 
    image-20261027-150706.png

  3. Create a key: Creating a CSA in the web app doesn't generate a key by default. You need to explicitly create it. Its expiration defaults to 90 days, and you can change it. When you create a CSA through the API or MCP, a key is still generated by default.
    image-20261027-150907.png

    ⚠️ The key is only shown once. Store it securely. It can't be retrieved again.

  4. Review or change access later: Select Access to see the filespaces and folders the CSA has been granted directly, and select Manage access to change them. This screen doesn't show access through groups. Showing group access in the web app is coming soon.

  5. Rotate or revoke keys: Replace or revoke a key from the CSA's key list. 
    For how rotation works end to end, see the Service Accounts KB article.

Requirements

Minimum client version: 3.9.9060

Related articles

Was this article helpful?

0 out of 0 found this helpful