Service accounts

1. In the web app, open Developer → Service accounts and create a new one.
2. Give it a name, such as "GitHub Actions production".
3. Choose the vaults and for each one Read or Read and write.
4. Choose an expiry: 30, 90 or 365 days or never.
5. Copy the token. Passbox shows it only once and closes the dialog only after you confirm that you stored it.

A lost token cannot be recovered. Create a new service account instead.

With the token, the command line uses the service account instead of your account:

export PASSBOX_SERVER=https://app.passbox.net
export PASSBOX_SERVICE_ACCOUNT_TOKEN=pbx_sa_…   # from your CI secret store
pbx read pbx://CI/Database/password
pbx run --env-file .env.pbx -- ./deploy.sh

All vault commands (item, list, get, read, inject, run, env, mcp) then run through the service account. pbx writes nothing to disk.

• The token contains a 256-bit secret. The server never sees it. pbx derives a key to authenticate and, separately, a key to decrypt. Someone with the server's database cannot open the service account's vaults.
• A service account never has more rights than the person who created it. If that person loses access to a vault or may only view it, the same applies to the service account right away.
• Guests cannot give service accounts access to vaults shared with them.

Under Developer → Service accounts you see each service account with its vaults and its activity. Every read and write is logged. You can add or remove vaults and revoke or delete the service account.

If a shared vault gets a new key because someone was removed, the service account can no longer read items encrypted again with it. That is deliberate: continued access should be a conscious decision. Choose Renew access then.

• One service account per pipeline, server or agent.
• A dedicated vault with only what the machine needs.
• Read access only where possible, and always an expiry date.
• Revoke the token when a machine is retired or the token may have leaked. Revoking takes effect at once. What someone downloaded with the token before, they may keep. Change the affected secrets then.

On passbox.net, up to ten active service accounts per person are included. In a Business organization, members share a pool of ten per member. On your own server there is no limit by default. The Service accounts page shows how many you use.

Not possible yet: service accounts owned by an organization instead of a person, IP restrictions, and replacing a token without creating a new service account.