Service Accounts

A service account is a workspace-scoped non-human identity. It has a token and can be assigned to target principals like a user or team.

Create and assign one

Create a service account for the workspace and save its token when it is returned. Then assign the service account to the required principal on each target.

Give automation only the principals it needs. Use separate service accounts for unrelated jobs so that tokens can be rotated independently.

Authenticate with nk

export NK_TOKEN=<SERVICE-ACCOUNT-TOKEN>
nk login
ssh ubuntu@target-name

The token can also be passed with the CLI’s --token option. The NK_TOKEN environment variable is usually safer for CI configuration than putting a token in a command line.

CI example

- name: Install nk
  run: curl -fsSL https://get.nokku.sh/nk | sh

- name: Connect to the target
  env:
    NK_TOKEN: ${{ secrets.NOKKU_TOKEN }}
  run: |
    nk login
    ssh ubuntu@target-name "systemctl restart my-service"

Store the token in the CI provider’s secret store. Do not commit it or print it in logs.

Expiration and removal

Service accounts may have an expiry. Removing the service account or its principal assignment prevents future access and certificate issuance. Existing certificates follow their normal expiry rules.