Cloud IAM Provision a Service ID with a Working API Key
A 4-step recipe with IBM. We can help you get access.
Recipe · 4 steps
Cloud IAM Provision a Service ID with a Working API Key
with IBM · Identity & Access Management
Provision a service ID, issue an API key for it, verify it, and lock it.
- Create the service ID in the target account. This is the identity the application will authenticate as, separate from any human user.
- Issue an API key for the identity. The key value is returned only at creation time, so store_value is set and the value is captured here or it is lost forever.
- Prove the newly issued key actually works by exchanging it for an IAM access token before the identity is handed to the application.
- Lock the service ID so it cannot be modified or deleted without an explicit unlock. The identity stays fully usable for authentication while locked.
What you'll need to have ready
- accountId: The IBM Cloud account ID the service ID belongs to.
- serviceIdName: The name of the service ID to create (e.g. "billing-exporter").
- iamId: The IAM ID the API key authenticates. For a service ID this is the service ID's own IAM ID, which is assigned when the service ID is created and is visible on t
- apiKeyName: The name of the API key to issue (e.g. "billing-exporter-key").
- serviceIdDescription: A description of what the service ID is used for.
- uniqueInstanceCrns: Optional CRNs restricting the service ID to specific resource instances.
For your developer
Arazzo workflow ibm:service-id-onboarding, 4 operations: createServiceId → createApiKey → createAccessToken → lockServiceId. Specs on APIs.io.