# Service account key

Canonical page: /glossary/service-account-key

API keys & secrets glossary, Keys & secrets. Service Account Key: Credentials for a Program, Not a Person

**Short answer:** A service account key is a credential that authenticates an automated process or program, rather than a human user. Cloud platforms typically issue it as a downloadable JSON file containing a private key, which the program loads at startup to authenticate its API calls.

## Why it matters

Because it is a file rather than a single string, a service account key is easy to accidentally commit to a repository or leave in a shared folder, and it usually grants broad, standing access until it is manually revoked.

## In Claude Keychain

Claude Keychain is built around single secret values rather than multi-field credential files, so a service account key is typically stored as the file's contents pasted in as one value, or the specific field a script actually needs.

## Common questions

**Is a service account key the same as an API key?**

Similar in purpose, but usually more powerful and longer-lived, which is why it deserves more caution.

**How often should a service account key be rotated?**

Cloud providers generally recommend rotating them on a schedule, such as every 90 days, and immediately after any suspected leak.

## Related

[API key rotation](/glossary/api-key-rotation), [Principle of least privilege](/glossary/least-privilege), [Hardcoded secret](/glossary/hardcoded-secret)