List and get service account keys

This page explains how to list and get service account keys using the Google Cloud console, the Google Cloud CLI , the Identity and Access Management API , or one of the Google Cloud Client Libraries .

Before you begin

• Enable the IAM API.

  Enable the API

• Set up authentication.

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

  gcloud

  In the Google Cloud console, activate Cloud Shell.

  Activate Cloud Shell

  At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  C#

  To use the .NET samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloud  
  auth  
  application-default  
  login

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity .

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  C++

  To use the C++ samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloud  
  auth  
  application-default  
  login

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity .

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  Go

  To use the Go samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloud  
  auth  
  application-default  
  login

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity .

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  Java

  To use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloud  
  auth  
  application-default  
  login

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity .

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  Python

  To use the Python samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloud  
  auth  
  application-default  
  login

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity .

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .

  For more information, see Authenticate for using REST in the Google Cloud authentication documentation.

• Understand service account credentials .

Required roles

To get the permissions that you need to list and get service account keys, ask your administrator to grant you the View Service Accounts ( roles/iam.serviceAccountViewer ) IAM role on either the project or the service account whose keys you want to manage. For more information about granting roles, see Manage access to projects, folders, and organizations .

You might also be able to get the required permissions through custom roles or other predefined roles .

For more information, see Service Accounts roles .

IAM basic roles also contain permissions to manage service account keys. You should not grant basic roles in a production environment, but you can grant them in a development or test environment.

List service account keys

You can list the service account keys for a service account using the Google Cloud console, the gcloud CLI, the serviceAccount.keys.list() method, or one of the client libraries .

The serviceAccount.keys.list() method is commonly used to audit service accounts and keys, or to build custom tooling for managing service accounts.

To find out which project your key belongs to, you can download the key as a JSON file and look at that file.

You might see keys listed that you did not create. These are keys created by Google and used by the Service Account Credentials API. To learn more, see Google-owned and managed key pairs .

gcloud iam service-accounts keys list \
    --iam-account= SA_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com

  namespace 
  
 iam 
  
 = 
  
 :: 
 google 
 :: 
 cloud 
 :: 
 iam_admin_v1 
 ; 
 []( 
 std 
 :: 
 string 
  
 const 
&  
 service_account_name 
 , 
  
 std 
 :: 
 vector<std 
 :: 
 string 
>  
 const 
&  
 key_type_labels 
 ) 
  
 { 
  
 iam 
 :: 
 IAMClient 
  
 client 
 ( 
 iam 
 :: 
 MakeIAMConnection 
 ()); 
  
 std 
 :: 
 vector<google 
 :: 
 iam 
 :: 
 admin 
 :: 
 v1 
 :: 
 ListServiceAccountKeysRequest 
 :: 
 KeyType 
>  
 key_types 
 ; 
  
 for 
  
 ( 
 auto 
  
 const 
&  
 type 
  
 : 
  
 key_type_labels 
 ) 
  
 { 
  
 if 
  
 ( 
 type 
  
 == 
  
 "USER_MANAGED" 
 ) 
  
 { 
  
 key_types 
 . 
 push_back 
 ( 
 google 
 :: 
 iam 
 :: 
 admin 
 :: 
 v1 
 :: 
  
 ListServiceAccountKeysRequest 
 :: 
 USER_MANAGED 
 ); 
  
 } 
  
 else 
  
 if 
  
 ( 
 type 
  
 == 
  
 "SYSTEM_MANAGED" 
 ) 
  
 { 
  
 key_types 
 . 
 push_back 
 ( 
 google 
 :: 
 iam 
 :: 
 admin 
 :: 
 v1 
 :: 
  
 ListServiceAccountKeysRequest 
 :: 
 SYSTEM_MANAGED 
 ); 
  
 } 
  
 } 
  
 auto 
  
 response 
  
 = 
  
 client 
 . 
 ListServiceAccountKeys 
 ( 
 service_account_name 
 , 
  
 key_types 
 ); 
  
 if 
  
 ( 
 ! 
 response 
 ) 
  
 throw 
  
 std 
 :: 
 move 
 ( 
 response 
 ). 
 status 
 (); 
  
 std 
 :: 
 cout 
 << 
 "ServiceAccountKeys successfully retrieved: " 
 << 
 response 
 - 
> DebugString 
 () 
 << 
 " 
 \n 
 " 
 ; 
 } 
 

  using 
  
 System 
 ; 
 using 
  
 System.Collections.Generic 
 ; 
 using 
  
  Google.Apis.Auth.OAuth2 
 
 ; 
 using 
  
 Google.Apis.Iam.v1 
 ; 
 using 
  
 Google.Apis.Iam.v1.Data 
 ; 
 public 
  
 partial 
  
 class 
  
 ServiceAccountKeys 
 { 
  
 public 
  
 static 
  
 IList<ServiceAccountKey> 
  
 ListKeys 
 ( 
 string 
  
 serviceAccountEmail 
 ) 
  
 { 
  
 var 
  
 credential 
  
 = 
  
  GoogleCredential 
 
 . 
  GetApplicationDefault 
 
 () 
  
 . 
  CreateScoped 
 
 ( 
 IamService 
 . 
 Scope 
 . 
 CloudPlatform 
 ); 
  
 var 
  
 service 
  
 = 
  
 new 
  
 IamService 
 ( 
 new 
  
 IamService 
 . 
 Initializer 
  
 { 
  
 HttpClientInitializer 
  
 = 
  
 credential 
  
 }); 
  
 var 
  
 response 
  
 = 
  
 service 
 . 
 Projects 
 . 
 ServiceAccounts 
 . 
 Keys 
  
 . 
 List 
 ( 
 $"projects/-/serviceAccounts/{serviceAccountEmail}" 
 ) 
  
 . 
 Execute 
 (); 
  
 foreach 
  
 ( 
 ServiceAccountKey 
  
 key 
  
 in 
  
 response 
 . 
 Keys 
 ) 
  
 { 
  
 Console 
 . 
 WriteLine 
 ( 
 "Key: " 
  
 + 
  
 key 
 . 
 Name 
 ); 
  
 } 
  
 return 
  
 response 
 . 
 Keys 
 ; 
  
 } 
 } 
 

  import 
  
 ( 
  
 "context" 
  
 "fmt" 
  
 "io" 
  
 iam 
  
 "google.golang.org/api/iam/v1" 
 ) 
 // listKey lists a service account's keys. 
 func 
  
 listKeys 
 ( 
 w 
  
 io 
 . 
 Writer 
 , 
  
 serviceAccountEmail 
  
 string 
 ) 
  
 ([] 
 * 
 iam 
 . 
 ServiceAccountKey 
 , 
  
 error 
 ) 
  
 { 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 service 
 , 
  
 err 
  
 := 
  
 iam 
 . 
 NewService 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 nil 
 , 
  
 fmt 
 . 
 Errorf 
 ( 
 "iam.NewService: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 resource 
  
 := 
  
 "projects/-/serviceAccounts/" 
  
 + 
  
 serviceAccountEmail 
  
 response 
 , 
  
 err 
  
 := 
  
 service 
 . 
 Projects 
 . 
 ServiceAccounts 
 . 
 Keys 
 . 
 List 
 ( 
 resource 
 ). 
 Do 
 () 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 nil 
 , 
  
 fmt 
 . 
 Errorf 
 ( 
 "Projects.ServiceAccounts.Keys.List: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 for 
  
 _ 
 , 
  
 key 
  
 := 
  
 range 
  
 response 
 . 
 Keys 
  
 { 
  
 fmt 
 . 
 Fprintf 
 ( 
 w 
 , 
  
 "Listing key: %v" 
 , 
  
 key 
 . 
 Name 
 ) 
  
 } 
  
 return 
  
 response 
 . 
 Keys 
 , 
  
 nil 
 } 
 

  import 
  
 com.google.cloud.iam.admin.v1. IAMClient 
 
 ; 
 import 
  
 com.google.iam.admin.v1. ListServiceAccountKeysRequest 
 
 ; 
 import 
  
 com.google.iam.admin.v1. ServiceAccountKey 
 
 ; 
 import 
  
 java.io.IOException 
 ; 
 import 
  
 java.util.List 
 ; 
 public 
  
 class 
 ListServiceAccountKeys 
  
 { 
  
 public 
  
 static 
  
 void 
  
 main 
 ( 
 String 
 [] 
  
 args 
 ) 
  
 throws 
  
 IOException 
  
 { 
  
 // TODO(Developer): Replace the below variables before running. 
  
 String 
  
 projectId 
  
 = 
  
 "your-project-id" 
 ; 
  
 String 
  
 serviceAccountName 
  
 = 
  
 "your-service-account-name" 
 ; 
  
 List<ServiceAccountKey> 
  
 keys 
  
 = 
  
 listKeys 
 ( 
 projectId 
 , 
  
 serviceAccountName 
 ); 
  
 keys 
 . 
 forEach 
 ( 
 key 
  
 - 
>  
 System 
 . 
 out 
 . 
 println 
 ( 
 "Key: " 
  
 + 
  
 key 
 . 
 getName 
 ())); 
  
 } 
  
 // Lists all keys for a service account. 
  
 public 
  
 static 
  
 List<ServiceAccountKey> 
  
 listKeys 
 ( 
 String 
  
 projectId 
 , 
  
 String 
  
 accountName 
 ) 
  
 throws 
  
 IOException 
  
 { 
  
 // Initialize client that will be used to send requests. 
  
 // This client only needs to be created once, and can be reused for multiple requests. 
  
 String 
  
 email 
  
 = 
  
 String 
 . 
 format 
 ( 
 "%s@%s.iam.gserviceaccount.com" 
 , 
  
 accountName 
 , 
  
 projectId 
 ); 
  
 try 
  
 ( 
  IAMClient 
 
  
 iamClient 
  
 = 
  
  IAMClient 
 
 . 
 create 
 ()) 
  
 { 
  
  ListServiceAccountKeysRequest 
 
  
 req 
  
 = 
  
  ListServiceAccountKeysRequest 
 
 . 
 newBuilder 
 () 
  
 . 
 setName 
 ( 
 String 
 . 
 format 
 ( 
 "projects/%s/serviceAccounts/%s" 
 , 
  
 projectId 
 , 
  
 email 
 )) 
  
 . 
 build 
 (); 
  
 return 
  
 iamClient 
 . 
 listServiceAccountKeys 
 ( 
 req 
 ). 
 getKeysList 
 (); 
  
 } 
  
 } 
 } 
 

  from 
  
 typing 
  
 import 
 List 
 from 
  
 google.cloud 
  
 import 
 iam_admin_v1 
 from 
  
 google.cloud.iam_admin_v1 
  
 import 
 types 
 def 
  
 list_keys 
 ( 
 project_id 
 : 
 str 
 , 
 account 
 : 
 str 
 ) 
 - 
> List 
 [ 
 iam_admin_v1 
 . 
 ServiceAccountKey 
 ]: 
  
 """Creates a key for a service account. 
 project_id: ID or number of the Google Cloud project you want to use. 
 account: ID or email which is unique identifier of the service account. 
 """ 
 iam_admin_client 
 = 
 iam_admin_v1 
 . 
 IAMClient 
 () 
 request 
 = 
 types 
 . 
 ListServiceAccountKeysRequest 
 () 
 request 
 . 
 name 
 = 
 f 
 "projects/ 
 { 
 project_id 
 } 
 /serviceAccounts/ 
 { 
 account 
 } 
 " 
 response 
 = 
 iam_admin_client 
 . 
 list_service_account_keys 
 ( 
 request 
 = 
 request 
 ) 
 return 
 response 
 . 
 keys 
 

GET https://iam.googleapis.com/v1/projects/ PROJECT_ID 
/serviceAccounts/ SA_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com/keys?keyTypes= KEY_TYPES 

curl -X GET \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://iam.googleapis.com/v1/projects/ PROJECT_ID 
/serviceAccounts/ SA_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com/keys?keyTypes= KEY_TYPES 
"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method GET `
-Headers $headers `
-Uri "https://iam.googleapis.com/v1/projects/ PROJECT_ID 
/serviceAccounts/ SA_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com/keys?keyTypes= KEY_TYPES 
" | Select-Object -Expand Content

{
  "keys": [
    {
      "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/90c48f61c65cd56224a12ab18e6ee9ca9c3aee7c",
      "validAfterTime": "2020-03-04T17:39:47Z",
      "validBeforeTime": "9999-12-31T23:59:59Z",
      "keyAlgorithm": "KEY_ALG_RSA_2048",
      "keyOrigin": "GOOGLE_PROVIDED",
      "keyType": "USER_MANAGED"
    },
    {
      "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/e5e3800831ac1adc8a5849da7d827b4724b1fce8",
      "validAfterTime": "2020-03-31T23:50:09Z",
      "validBeforeTime": "9999-12-31T23:59:59Z",
      "keyAlgorithm": "KEY_ALG_RSA_2048",
      "keyOrigin": "GOOGLE_PROVIDED",
      "keyType": "USER_MANAGED"
    },
    {
      "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/b97699f042b8eee6a846f4f96259fbcd13e2682e",
      "validAfterTime": "2020-05-17T18:58:13Z",
      "validBeforeTime": "9999-12-31T23:59:59Z",
      "keyAlgorithm": "KEY_ALG_RSA_2048",
      "keyOrigin": "GOOGLE_PROVIDED",
      "keyType": "USER_MANAGED",
      "disabled": true
      "disable_reason": "SERVICE_ACCOUNT_KEY_DISABLE_REASON_EXPOSED"
      "extended_status": "SERVICE_ACCOUNT_KEY_EXTENDED_STATUS_KEY_EXPOSED"
      "extended_status_message": "exposed at: https://www.github.com/SomePublicRepo"
    }
  ]
}

Get a service account key

You can use the gcloud CLI or the REST API to get the public key data for a service account key. In addition, you can use the Google Cloud console, the gcloud CLI, or the REST API to get metadata for the key, such as the algorithm that the key uses and whether the key is managed by you or by Google.

Some applications or tools might need access to the public key data or metadata for a service account key for things like auditing and interoperability with external systems. For example, Terraform might need to verify that the state of a service account key in Google Cloud matches what's defined in the Terraform configuration file.

gcloud  
beta  
iam  
service-accounts  
keys  
get-public-key  
 KEY_ID 
  
 \ 
  
--iam-account = 
 SA_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com  
 \ 
  
--output-file = 
 FILENAME 

 gcloud  
beta  
iam  
service-accounts  
keys  
get-public-key  
 \ 
  
c97cc34494c07c9b483701f28368f20145b9ef97  
 \ 
  
--iam-account = 
my-service-account@my-project.iam.gserviceaccount.com  
 \ 
  
--output-file = 
public_key.pem 

gcloud  
iam  
service-accounts  
keys  
list  
--iam-account = 
 SA_NAME 
  
 \ 
  
--filter = 
 "name~ KEY_ID 
" 
  
--format = 
json

 gcloud  
iam  
service-accounts  
keys  
list  
 \ 
  
--iam-account = 
my-service-account@my-project.iam.gserviceaccount.com  
 \ 
  
--filter = 
 "name~c97cc34494c07c9b483701f28368f20145b9ef97" 
  
--format = 
json 

GET https://iam.googleapis.com/v1/projects/ PROJECT_ID 
/serviceAccounts/ SA_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com/keys/ KEY_ID 
?publicKeyType= KEY_TYPE 

curl -X GET \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://iam.googleapis.com/v1/projects/ PROJECT_ID 
/serviceAccounts/ SA_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com/keys/ KEY_ID 
?publicKeyType= KEY_TYPE 
"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method GET `
-Headers $headers `
-Uri "https://iam.googleapis.com/v1/projects/ PROJECT_ID 
/serviceAccounts/ SA_NAME 
@ PROJECT_ID 
.iam.gserviceaccount.com/keys/ KEY_ID 
?publicKeyType= KEY_TYPE 
" | Select-Object -Expand Content

{
  "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/f4a83933ac07cf52bb74e0e66d99662a09f51a36",
  "validAfterTime": "2021-12-10T17:32:06Z",
  "validBeforeTime": "9999-12-31T23:59:59Z",
  "publicKeyData": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvRENDQWVTZ0F3SUJBZ0lJT2lCdm9hR09nV0F3RFFZSktvWklodmNOQVFFRkJRQXdJREVlTUJ3R0ExVUUKQXhNVk1UQXhNVGsxTlRFMk5UWXlPRGszTmpFek1qQXpNQ0FYRFRJeE1USXhNREUzTXpJd05sb1lEems1T1RreApNak14TWpNMU9UVTVXakFnTVI0d0hBWURWUVFERXhVeE1ERXhPVFUxTVRZMU5qSTRPVGMyTVRNeU1ETXdnZ0VpCk1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQzdzeDBFcXVUMGNwSXhlczl1SW0yRy9DS3EKdnc4YTl2a2JkaWZZbDZHSDh1ZUxEWDhGNHVUeEVQMkNzU3JLTHZtOFo2My9IVUxnWjBtQXByb0JlM08vaVR1ZwpmYVZ0NVNtakhvWm9YQ1lpbjR0MS93SkpvdDhrRFdPeDZhOEdieUdqZ215ak8yYk1XdEtaQ2dqeGZ3cUV0MmN3CklnajA5VzJKYTlHTWRsdVA0VGVubTRKSkJoaFpFbTJ1bVAwYVZZdkRnUWF5d0RCYnJuNG8yY0EzSWplRDZGM1gKK0VHRDNKU0s4VW02Sk5sM21adGp6VWNZSHBrYkF0U1A2ZDI5d1RmZkdIRFY0THJRWlM3bG15d3hsb3p5WnpaawpCOFpHckMzSkF1MVNVRTdQOTN6bWtFb1B6MlRUNWhaYXZMWFQ5TGM2SExiRklRVHFnVEJVWHlNMkpIcGZBZ01CCkFBR2pPREEyTUF3R0ExVWRFd0VCL3dRQ01BQXdEZ1lEVlIwUEFRSC9CQVFEQWdlQU1CWUdBMVVkSlFFQi93UU0KTUFvR0NDc0dBUVVGQndNQ01BMEdDU3FHU0liM0RRRUJCUVVBQTRJQkFRQkhPNXlpUDY3NkE4UEN2RjdRSzdFMApYZVljbzdsSStFZkowaGJrWVlmdUtnSENPcXcvd3FBbCtOSithanljT2FPWDFPMlRZN3ZOc05pR2t3eWc2QXdqCklhL1NHVjd3NkxpS2JldFRuSVp4UlhRY25lcnVvZEwycUR5eWphMDJJSXJVTmVKY1o0MVJBNXRTL3NkcTFGNm4KM0NjSXFoZTI1OTA4TUNna3cwaFB1K0VLbFF6R1B5T3pVRHBLdXg0cnRBaHJTYTBUVW1wbEMxdTJnUk1YRkF6aApWUjU0V2dNa2tabURyalBNeWdBS3JmNkd0bHo2VHRTYTVLb1BWdGpsWExUQkxaSnlhdk4zc1F2dFlBK1NFQWpWCnA1N1ZabFBYZmR0dWN4ekJaOC9zS25SOHNyYU5hVWFjamg1NEE1Nm1URTE3b0IyUWkrTHBJUTYvNnVqVnNXaUYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=",
  "keyAlgorithm": "KEY_ALG_RSA_2048",
  "keyOrigin": "GOOGLE_PROVIDED",
  "keyType": "USER_MANAGED"
}

What's next

• Learn how to create and delete service account keys .
• Learn how to disable and enable service account keys .
• Learn about alternatives to service account keys for authentication .
• Learn how to use service account keys to authenticate as a service account .
• Understand the best practices for managing service account keys .