opschain admin service-accounts create
Included from Basic tier
opschain admin service-accounts create <username>
Mints a service account: a users row with auth_provider = service_account, no credential and no login lane (v2
UserService.CreateServiceAccount, admin-gated on the step-up floor). The
new principal starts with no authority — grant it access via policy
assignments or group membership, then point automations at it with
run_as. In the GUI the same mint is Administration → Users → Create
service account….
The username must not be held by any existing identity, whatever its provider: run-as resolves identities by username, so a collision would make firing-time authority ambiguous. A clash is a named refusal.
opschain admin service-accounts create deploy-bot
Created service account deploy-bot (id 019a…)
Grant it authority via policy assignments or group membership, then point automations at it with run_as.
-o json|yaml prints the created user document.
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
Exit codes: 0 on success, 1 when the username is taken or the token is rejected, 2 for the connection usage errors.
See also
opschain docs cli/admin-service-accounts— the model and the verbs.opschain docs cli/admin-groups— give it authority through a group.