Keycyte PAM 3.2 · Administrator Guide

Service Identities

A service identity is a user account for an application rather than a person. Applications use it to retrieve credentials from Keycyte PAM through the Secrets API. A service identity has the SERVICE role and authenticates with API keys, not with a password.

An account that has only the SERVICE role is refused at every interactive sign-in: the Admin Panel, the Client Panel, and SSH or RDP connections.

Before you begin, make sure that you have the Add and Edit permissions for Users.

Creating a Service Identity

To create a service identity:

1. Select Users in the menu and click Add (tooltip New User).
2. In Type, keep Local.
3. Enter a Username that names the application, for example svc-backup.
4. Enter a Password. The panel requires a password for every new local user; an account with only the SERVICE role cannot sign in with it.
5. In Roles, select only SERVICE. The panel shows Service account — cannot sign in.
6. Fill in Description and other fields as needed.
7. Click Save.

The account can retrieve the vault accounts that its password roles grant. Authorize the account in a password role that contains the accounts the application needs. See Password Roles.

Issuing an API Key

To issue an API key:

1. In the user list, click API Keys (key icon) in the row of the service identity. The API Keys dialog opens.
2. In Label, enter a name that identifies where the key is used, for example blue or green.
3. In Expiry, select how long the key is valid: 30 days, 90 days, 180 days, 365 days or Never expires. Default: 90 days.
4. If you select Never expires, enter the reason in Why does this key never expire?. The reason is recorded for audits.
5. Click Issue key.

The Key issued box shows the key ID and the secret. Copy the secret with Copy secret and store it in the application’s configuration.

A service identity can hold at most two active keys at a time. Two keys let you rotate without downtime: issue the new key, update the application, then revoke the old key.

Monitoring and Revoking Keys

The API Keys dialog lists the keys of the identity with their Label, Status, Expiry and Last used time. A key that has not been used for a long time is marked Dormant; this also applies to keys that never expire.

To revoke a key, click Revoke in its row and confirm. Any application that still uses the key stops working immediately.

To remove a revoked key from the list, click Delete permanently. The revocation stays in the system log.

Using the Key

The API Keys dialog links to the Integration guide and the OpenAPI spec of the Secrets API. For how applications authenticate and retrieve secrets, see Secrets API.