curl --request POST \
--url https://cockroachlabs.cloud/api/v1/service-accounts/{service_account_id}/credentials \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \
--json '{"algorithm":"RS256","expires_at":"2023-03-22T20:23:11.285067Z","name":"ci signer","public_key":"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkq...\n-----END PUBLIC KEY-----\n","service_account_id":"abcd1234-abcd-abcd-1234-abcdef123456"}'{
"algorithm": "RS256",
"client_id": "crl-sa_abc123",
"created_at": "2022-03-22T20:23:11.285067Z",
"credential_type": "JWT_BEARER",
"expires_at": "2023-03-22T20:23:11.285067Z",
"id": "1234abcd-1234-1234-abcd-12345678abcd",
"name": "ci signer",
"service_account_id": "abcd1234-abcd-abcd-1234-abcdef123456"
}{
"code": 123,
"details": [
{
"@type": "<string>"
}
],
"message": "<string>"
}Create an OAuth credential for a service account
Can be used by the following roles assigned at the organization scope:
- ORG_ADMIN
curl --request POST \
--url https://cockroachlabs.cloud/api/v1/service-accounts/{service_account_id}/credentials \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \
--json '{"algorithm":"RS256","expires_at":"2023-03-22T20:23:11.285067Z","name":"ci signer","public_key":"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkq...\n-----END PUBLIC KEY-----\n","service_account_id":"abcd1234-abcd-abcd-1234-abcdef123456"}'{
"algorithm": "RS256",
"client_id": "crl-sa_abc123",
"created_at": "2022-03-22T20:23:11.285067Z",
"credential_type": "JWT_BEARER",
"expires_at": "2023-03-22T20:23:11.285067Z",
"id": "1234abcd-1234-1234-abcd-12345678abcd",
"name": "ci signer",
"service_account_id": "abcd1234-abcd-abcd-1234-abcdef123456"
}{
"code": 123,
"details": [
{
"@type": "<string>"
}
],
"message": "<string>"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
The ID of the service account to create the credential for.
Body
- RS256: RS256 (RSASSA-PKCS1-v1_5 using SHA-256).
- PS256: PS256 (RSASSA-PSS using SHA-256).
- ES256: ES256 (ECDSA using P-256 and SHA-256).
- ES384: ES384 (ECDSA using P-384 and SHA-384).
RS256, PS256, ES256, ES384 Required. When the credential expires; must be in the future. There is no maximum lifetime.
"2023-03-22T20:23:11.285067Z"
A human-readable name for the credential.
"ci signer"
The PEM-encoded public key used to verify signed JWT assertions.
"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkq...\n-----END PUBLIC KEY-----\n"
An optional longer description.
Response
A successful response.
ServiceAccountCredential is an OAuth 2.0 jwt-bearer credential a service account uses to obtain short-lived access tokens. CockroachDB Cloud stores only the public key and signature algorithm; it never holds a secret on the customer's behalf.
- RS256: RS256 (RSASSA-PKCS1-v1_5 using SHA-256).
- PS256: PS256 (RSASSA-PSS using SHA-256).
- ES256: ES256 (ECDSA using P-256 and SHA-256).
- ES384: ES384 (ECDSA using P-384 and SHA-384).
RS256, PS256, ES256, ES384 The public OAuth client identifier; also the iss and sub a signed assertion must carry.
"crl-sa_abc123"
When the credential was created.
"2022-03-22T20:23:11.285067Z"
- JWT_BEARER: JWT_BEARER authenticates with a client-held private key via an OAuth 2.0 jwt-bearer assertion (RFC 7523).
JWT_BEARER When the credential expires. Always set; a credential cannot be created without an expiry.
"2023-03-22T20:23:11.285067Z"
The unique ID of the credential.
"1234abcd-1234-1234-abcd-12345678abcd"
A human-readable name for the credential.
"ci signer"
The ID of the service account the credential belongs to.
"abcd1234-abcd-abcd-1234-abcdef123456"
An optional longer description.
When the credential was disabled; unset if active.