> ## Documentation Index > Fetch the complete documentation index at: https://docs.fiddler.ai/llms.txt > Use this file to discover all available pages before exploring further. # Service Accounts > Create organization-owned service accounts and API keys so collectors and pipelines can send traces to Fiddler without relying on a personal API key. > [!NOTE] > > This capability is currently in [private preview](/reference/feature-maturity-definitions#private-preview) and is not yet available to all customers. Contact your Fiddler Customer Success Manager to request access. ## Overview A service account is an identity owned by your organization, not by a person. Its API keys let integrations, such as an OpenTelemetry collector, send traces to Fiddler. A personal API key acts as the person who created it, so it breaks or changes behavior when that person leaves or changes roles. Service account keys belong to the organization and carry only the permissions you grant. Use a service account when a workload, not a person, needs to send traces to Fiddler. Use a [personal API key](/reference/administration/settings#credentials) for your own scripts and notebooks. Fiddler service accounts are separate from cloud-provider service accounts, such as the Google Cloud service account you use for the [LLM Gateway](/reference/administration/llm-gateway). ### Key Facts These facts apply to service accounts created with **Entire Org**, the only choice available today. * A key from an **Entire Org** service account can send traces to **every** GenAI application in your organization. You can't limit a key to one application. * Fiddler shows the full key once. Anyone who has it can send trace data until you disable or revoke it. * An **Entire Org** key can't read your monitored data or change settings, and the LLM Gateway rejects it. * Fiddler doesn't send expiration emails, so an expired key stops ingestion without an email warning. ## Prerequisites * You are an Org Admin. Only Org Admins can create and manage service accounts. * Fiddler has enabled service accounts for your Fiddler environment. Because this is a private preview, talk to your Fiddler contact before you move a production workload onto it. * You are using the new Fiddler UI. To open it, add `preview.` to the start of your Fiddler address, as described in the [New Fiddler UI quick start](/getting-started/new-ui-preview-quick-start). ## How Service Accounts Work ### Capabilities In the create dialog, **Capabilities** has two parts. The **Entire Org** or **Specific Projects** choice sets where the service account applies. The capability checkboxes, such as `traces:ingest`, set what it can do. **Entire Org** is the only choice available today, and **Specific Projects** shows as coming soon. A capability is something a service account is allowed to do. A service account can't send traces until you grant it the `traces:ingest` capability, and its keys can use only the capabilities it has. | Capability | What it allows | | - | - | | `traces:ingest` | Send traces and spans to Fiddler from SDKs, gateways, and collectors | `traces:ingest` is the only capability today. ### API Keys Each service account can have 10 API keys by default. | Property | Behavior | | - | - | | **Format** | Starts with `fks_`. | | **Visibility** | Fiddler shows the full key once, at creation. Afterward, the page shows only the last six characters, as the **Key Suffix**. | | **Expiration** | 30 days to 2 years from creation. You can't change it, so create a new key to extend access. | | **Status** | **Active**, **Disabled**, or **Expired**. | | **Revocation** | Only a disabled or expired key can be revoked. Revoking deletes the key. | | **Limit** | Disabled and expired keys count toward the limit until you revoke them. | A key works only while the key and its service account are both active and the key hasn't expired. ## Create a Service Account **1. Open Service Accounts** Go to **Settings > Access Control > Service Accounts**. ![The Service Accounts page in Settings, listing service accounts with their capability, creator, status, and key count](https://mintlify.s3.us-west-1.amazonaws.com/fiddlerai/images/service-accounts-list.png) **2. Open the Create Dialog** Click **Create Service Account**. **3. Name the Service Account** Enter a **Name** that is unique in your organization, for example `otel-collector-prod`. Names start with a letter and can contain letters, digits, spaces, hyphens, and underscores (up to 128 characters). Optionally, add a **Description**, such as the team that owns the integration. **4. Grant a Capability** Under **Capabilities**, keep **Entire Org** selected and select `traces:ingest`. ![The Create Service Account dialog showing name and description fields, Entire Org selected, and the traces:ingest capability checked](https://mintlify.s3.us-west-1.amazonaws.com/fiddlerai/images/service-accounts-create-dialog.png) **5. Create** In the dialog, click **Create Service Account**. The new service account appears in the list. Use one service account for each workload and environment, so you can disable one integration without affecting others. Name it after the workload and environment, such as `-`. ## Create an API Key **1. Open the Service Account** On the **Service Accounts** page, click the service account's name. The detail page shows its **Capabilities** and its **API Keys**. ![A service account detail page showing its capabilities and an API Keys table with key name, Key Suffix, status, and expiration date](https://mintlify.s3.us-west-1.amazonaws.com/fiddlerai/images/service-accounts-detail.png) **2. Name the Key** In **API Keys**, click **Create API Key**. Enter an **API Key Name** that is unique within the service account. Names follow the same rules as service account names. **3. Choose an Expiration** Select **30 Days**, **90 Days**, or **365 Days** (the default), or select **Custom** to enter 30 to 730 days. Choose the shortest lifetime you can rotate reliably. ![The Create API Key dialog showing the API Key Name field and the Expiration dropdown](https://mintlify.s3.us-west-1.amazonaws.com/fiddlerai/images/service-accounts-create-api-key-dialog.png) **4. Copy the Key** > [!WARNING] > > Fiddler shows the full key only once and can't retrieve it later. > If you lose it, create a new key. Click **Create API Key**. In the **API Key Created** dialog, copy the key and store it in your secrets manager, then click **Done**. ![The API Key Created dialog showing the key name, the service account, and the one-time key with a copy button](https://mintlify.s3.us-west-1.amazonaws.com/fiddlerai/images/service-accounts-api-key-created.png) ## Send Traces with a Service Account Key Use the complete key, starting with `fks_`, in place of the access token in the [OpenTelemetry quick start](/developers/quick-starts/opentelemetry-quick-start): ```bash theme={null} export OTEL_EXPORTER_OTLP_ENDPOINT="https://your-instance.fiddler.ai" export OTEL_EXPORTER_OTLP_HEADERS="authorization=Bearer ,fiddler-application-id=" export OTEL_RESOURCE_ATTRIBUTES="application.id=" ``` Keep the `fiddler-application-id` header. The key doesn't choose the application. To send to several applications with one key, see [multi-application trace routing](/integrations/agentic-ai/multi-application-trace-routing). To confirm that it works, send a test trace and check that it appears in the application in Fiddler. If it doesn't, see [Troubleshooting](#troubleshooting). ## Manage Service Accounts Changes usually apply on the next request. Allow up to 5 minutes for a disable or revoke to take full effect. With [multi-application trace routing](/integrations/agentic-ai/multi-application-trace-routing), allow up to 10 minutes by default. ### Rotate an API Key Rotate keys before they expire, or on a regular schedule. **1. Create a New Key** Create a new key on the service account. **2. Update Your Integration** Put the new key in your collector or exporter configuration, then redeploy it. Confirm that traces still arrive. **3. Disable the Old Key** Open the old key's **⋯** (Row actions) menu, select **Disable**, and confirm. **4. Revoke the Old Key** After you're sure nothing depends on the old key, open its **⋯** menu, select **Revoke**, type `revoke`, and click **Revoke API Key**. ### Respond to a Leaked Key Add the `fks_` prefix to your secret-scanning rules to catch leaks early. A leaked key can read server information (version, feature flags, organization name) and list your organization's application IDs, but it can't read your monitored data. If a key might have leaked, act right away: 1. Disable the exposed key. If you don't know which key leaked, disable the service account instead. 2. Create a new key and put it in your integration. A new key doesn't work while its service account is disabled. 3. If you disabled the service account, first disable every older key on it. Enabling a service account restores every key that isn't disabled on its own, including the leaked one. Then enable the service account. 4. Revoke the exposed key. 5. Review recent traces in your applications for data you didn't send. ### Change a Service Account Open the service account and click **Edit**. You can change the name, the description, and the capabilities, then click **Save**. A capability change applies to all of the service account's keys. A service account with no capabilities can't send traces. ### Disable or Enable a Service Account You can't delete a service account. To stop one, disable it: all of its keys stop working. Enabling it again restores the keys that are still active and unexpired. Use the service account's row menu on the **Service Accounts** page, or the button on its detail page. Select **Disable** or **Enable**, then confirm. ### Change a Key's Status Use the **⋯** menu on the key's row. | Key status | Available actions | | - | - | | **Active** | **Disable** | | **Disabled** | **Enable**, **Revoke** | | **Expired** | **Revoke** | Replace keys that show **Expiring Soon** before they expire. ## Limitations * **Entire Org** is the only choice. Limiting a service account to specific projects isn't available yet. * `traces:ingest` is the only capability. * Service account keys can't call the REST API or the Fiddler Python client, except to connect and send traces. * A service account key can only send traces. SDK features that call other Fiddler APIs, such as `normalize_multimodal=True` in the Fiddler OpenTelemetry SDK, are rejected with **403 Forbidden**, and the SDK keeps the content inline. ## Troubleshooting | Symptom | Likely cause | What to do | | - | - | - | | **401 Unauthorized** when sending traces | The key is disabled, expired, or revoked, its service account is disabled, or the key was copied incorrectly | Check the key's status and expiration on the service account page. Create a new key if needed. | | **403 Forbidden** with the message `API key scope does not permit this operation` | The service account doesn't have `traces:ingest`, or the key was used for something other than sending traces | Edit the service account and grant `traces:ingest`. Use a personal API key for other calls. | | **403 Forbidden** with the message `Not authorized to ingest to this application` | The application ID is wrong, or the application belongs to another organization | Check the application ID in your collector configuration. | | **403 Forbidden** with the message `Service-account keys cannot call the LLM gateway` | The LLM Gateway doesn't accept service account keys | Use a personal API key to call the gateway. | | A disabled key still works for a few minutes | Fiddler takes time to apply a change | Wait, then check again. See [Manage Service Accounts](#manage-service-accounts) for timing. | | **Create API Key** is unavailable | The service account reached its key limit | Revoke keys you no longer need. Disabled and expired keys count toward the limit. | | **Service Accounts** doesn't appear in Settings | You aren't an Org Admin, you aren't using the new UI, or service accounts aren't enabled for your Fiddler environment | Check each, or contact your Fiddler Customer Success Manager. | ## Related Resources * [OpenTelemetry Quick Start](/developers/quick-starts/opentelemetry-quick-start) - Send your first trace * [Multi-Application Trace Routing](/integrations/agentic-ai/multi-application-trace-routing) - Send to several applications with one key * [API Keys](/reference/administration/settings#credentials) - Manage your personal API keys * [Role-Based Access Control](/reference/access-control/role-based-access) - Understand user roles and permissions * [Feature Maturity Definitions](/reference/feature-maturity-definitions#private-preview) - What private preview means