Service account key
A service account key is a credential that authenticates an automated process or program, rather than a human user. Cloud platforms typically issue it as a downloadable JSON file containing a private key, which the program loads at startup to authenticate its API calls.
Why it matters
Because it is a file rather than a single string, a service account key is easy to accidentally commit to a repository or leave in a shared folder, and it usually grants broad, standing access until it is manually revoked.
Is a service account key the same as an API key?
Similar in purpose, but usually more powerful and longer-lived, which is why it deserves more caution.
How often should a service account key be rotated?
Cloud providers generally recommend rotating them on a schedule, such as every 90 days, and immediately after any suspected leak.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.