Service accounts - Port of Context

A service account is a machine identity with its own API keys. Use one to publish indexed sources or sync the context map from CI. It acts with a member’s access, narrowed to the permissions you pick.

Create one

Open Admin → Service accounts and select New service account.
Give it a name and description, and tick the permissions it needs.
Select Add and copy the key. It is shown once.

Permissions

Permission	Allows
`org:context:read`	Read the context map and its rules
`org:context:write`	Add and edit entities, connections, domains, and map rules
`org:context:propose`	Submit map changes for a person to review
`org:context:restrict`	Restrict sharing on nodes it is allowed to manage
`org:corpus:read`	List indexed sources and their index status
`org:corpus:write`	Publish and manage indexed sources
`org:mcp:write`	Register and remove custom MCP servers
`org:connections:write`	Store credentials for connected services
`org:insights:read`	Read usage insights and gateway call logs

Give an account the narrowest set that does its job. An account that should only suggest map changes needs org:context:propose, not org:context:write.

Let it publish to a source

A key with org:corpus:write is not enough on its own. Open the source, select Manage access, and tick the account under Publishers.

Rotate a key

Select Add key on the account. Existing keys keep working.
Update your script or CI secret with the new key.
Select Revoke key on the old one.

A revoked key can then be deleted. To retire an account, select Revoke account, then Delete account.