Service Account

ELI5 — The Vibe Check

A service account is a special non-human account that your app or service uses to authenticate with cloud APIs. Instead of using your personal login in your code (terrifying), you create a service account with only the permissions the app needs. It's like giving your app its own ID card with limited access.

Real Talk

A service account is an identity used by applications, VMs, or services — not humans — to authenticate with cloud APIs and access resources. In GCP, they're first-class identities with JSON key files or workload identity federation. In AWS, IAM roles are used instead of service accounts. Principle of least privilege applies.

Show Me The Code

// GCP — authenticate with a service account
import { GoogleAuth } from 'google-auth-library';
const auth = new GoogleAuth({
  keyFilename: './service-account.json',
  scopes: ['https://www.googleapis.com/auth/cloud-platform']
});
const client = await auth.getClient();
const token = await client.getAccessToken();

When You'll Hear This

"Create a service account with read-only BigQuery access for the data pipeline." / "Never commit service account JSON keys to your repo."