Skip to main content
Service principals are machine identities in C1. They give your scripts, CI/CD pipelines, and Terraform runs their own identity and credentials, separate from any human user.

​
What’s a service principal?

A service principal is a dedicated, non-human identity purpose-built for automation. It appears in the user directory alongside human users, but it’s designed for scripts, CI/CD pipelines, Terraform runs, and API integrations. Each service principal:
  • Has a display name and unique ID
  • Can be assigned C1 roles, just like a human user
  • Has owners who manage it
  • Can have multiple credentials or federation trusts
You don’t need a service principal to use the C1 API for personal use. You can use existing personal API credentials (Profile > AI & API > API credentials) for individual tasks. Service principals are designed for shared automation where the identity should not be tied to a specific person.

​
Two ways to authenticate

Service principals support two authentication methods. You can use either one, or both on the same service principal.

​
Choosing the right method

  • Use client credentials if you want a straightforward path to calling the API. Best for scripts, local development, and environments where storing a secret is acceptable.
  • Use workload federation for production CI/CD. No secrets to rotate, tighter scoping, and tokens are tied to individual workflow runs.

​
Environment variables

All C1 client tools (Go SDK, Terraform provider, Cone CLI, oidc-token-action) recognize the same environment variables: When multiple variables are set, tools use this priority order:
  1. CONDUCTORONE_ACCESS_TOKEN — static bearer token, no exchange needed
  2. CONDUCTORONE_OIDC_TOKEN — token exchange using CONDUCTORONE_CLIENT_ID
  3. CONDUCTORONE_CLIENT_ID + CONDUCTORONE_CLIENT_SECRET — Ed25519 JWT assertion

​
Before you begin

Before creating service principals:
  1. Contact your C1 account team to enable the feature.
  2. You need Super Admin permissions to create and manage service principals.

​
Next steps

Quick start: Client credentials

Get from zero to a working API call in under 5 minutes.

Workload federation

Set up secretless authentication from CI/CD platforms.

​
Service principal limits

Credential expiration can’t be extended after creation. To continue access, create a new credential with the desired expiration and revoke the old one. See credential rotation.