Service accounts give your integrations their own identity in SmartSuite. A service account is separate from any person, is owned by your organization, and can only reach the data you explicitly grant it. Administrators can create service accounts, issue API key or OAuth credentials for them, and review what each one does.
Plan Availability | All plans: Team, Professional, Enterprise and Signature |
Permissions | Administrators: create and manage service accounts, their credentials, and their access |
Related Reading |
Why use a service account instead of a user account?
Without service accounts, the usual way to run an integration is to create a dedicated user account and use its API key. That account takes up a paid seat, can sign in to SmartSuite like a person, and its key carries all of that account’s permissions. Service accounts solve each of these problems:
Does not use a paid seat. Service accounts don’t count toward your billed seats. You can create one even when your workspace has reached its member limit.
Cannot sign in. A service account can only authenticate through the API. Sign-in attempts are refused on every login method: password, SSO, and social login.
Owned by your organization. Each service account has a named owner and an optional backup owner. It keeps working when the person who created it leaves.
Only the access you grant. A service account doesn’t pick up access automatically. You grant it access to specific solutions and tables.
One credential per integration. You can issue several credentials for one service account and revoke any of them without affecting the others.
How do I set up a service account?
Create a service account
Open Service Accounts in your account settings and choose to add a new service account.
Enter a name and a description for the service account.
Choose an owner and, optionally, a backup owner. The owner defaults to you, and only Administrators can be selected.
Choose a role: Solution Creator, General, or Guest. Service accounts cannot be given the Administrator role.
Choose the credential type and its expiration.
Grant access to the solutions and tables the integration needs.
Save the service account. SmartSuite then prompts you to create its first credential.
Create a credential
Give the credential a name that identifies the integration that will use it, for example, the tool or pipeline name.
Generate the credential. An API key credential gives you a key. An OAuth credential gives you a client ID and a client secret.
Copy the key or secret and store it somewhere secure.
⚠️ Important: The key or client secret is shown only once, when you create it. SmartSuite can’t display it again. If you lose it, create a new credential and revoke the old one.
You can add more credentials at any time from the service account’s details page. The steps are the same.
Revoke a credential
From the service account’s details page, revoke the credential you no longer need. Only that credential stops working. Every other credential on the same service account keeps working.
Which credential types are there, and when do they expire?
API key: A single key that your integration sends with each request.
OAuth (client credentials): Your integration exchanges a client ID and client secret for short-lived access tokens. Those access tokens refresh automatically.
Client Secret Expiration controls when the long-lived client secret stops working. It doesn’t affect the short-lived access tokens. For OAuth credentials, the default is Never.
Expiration reminders: When a credential is within seven days of expiring, the service account’s owner and backup owner receive a daily email.
Each person gets one email per workspace, listing every credential that is about to expire.
The emails stop once the credential is replaced, revoked, or expires.
Credentials with no expiration date never trigger reminders.
An expired credential is flagged on the service account, and requests that use it fail with a message explaining why.
What can a service account access, and where does it appear?
Only Administrators control access. Only Administrators can add, change, or remove a service account’s access at the solution, table, or field level. Solution Managers can’t change it, and they don’t see service account access entries.
Access must be granted directly. A solution that gives access to all members does not give access to service accounts. A service account can only reach the solutions and tables an Administrator grants it.
No teams. A service account can’t be added to any team, including Everyone.
Hidden from people-focused areas. Service accounts don’t appear in member lists, search, or the Assigned To and User field pickers. They also don’t receive member notifications.
Not affected by identity provider sync. Service accounts are excluded from SCIM sync, so your identity provider won’t deprovision them.
How do I see what a service account did?
Record activity: Changes a service account makes to records are attributed to that service account, so you can tell machine activity apart from changes made by people.
Change history: Creating and revoking a credential each add an entry to the service account’s change history. The entry shows who made the change, when, and the credential’s name. Edits to the account’s name, owner, description, role, and status are recorded too.
Can I manage service accounts through the API?
You can manage service accounts entirely through the REST API, which lets you provision integrations from infrastructure-as-code.
Through the service accounts API, you can create service accounts and add, list, and revoke credentials.
Other details, such as name, owner, and role, are updated through the members API.
See the SmartSuite API Documentation for details.
Practical scenarios and use cases
1. Replace an integration user account. Scenario: Your team runs a sync on a dedicated user account that takes up a paid seat. Solution: Create a service account with the same access, point the integration at the new credential, and then deactivate the old user account. SmartSuite doesn’t migrate existing integration accounts automatically.
2. Contain a leaked key. Scenario: One of several integrations exposes its credential. Solution: Give each integration its own credential on the service account. Revoke only the exposed credential, and the other integrations keep running.
3. Limited access for a reporting tool. Scenario: An analytics platform needs data from two tables. Solution: Create a service account with the Guest role and grant it access to just those two tables.
4. Provision with infrastructure-as-code. Scenario: Your platform team wants integrations created and torn down automatically. Solution: Use the API to create the service account, issue and rotate credentials, and revoke them when the integration is retired.
Summary
Service accounts let integrations run on their own organization-owned identity. They don’t use a seat, can’t sign in, and only have the access an Administrator grants. Each integration can have its own credential, which you can revoke on its own, and owners get reminder emails before a credential expires.
Frequently asked questions
Does a service account use a paid seat?
No. Service accounts do not count toward your billed seats, and you can create one even when your workspace has reached its member limit.
Can a service account sign in to SmartSuite?
No. A service account authenticates only through the API. Password, SSO and social sign-in attempts are refused.
Can a service account be an Administrator?
No. The available roles are Solution Creator, General and Guest.
I lost the API key or client secret. Can SmartSuite show it again?
No. The key or client secret is shown once, when you create it. Create a new credential and revoke the old one.
Do existing integration user accounts move to service accounts automatically?
No. Create a service account with the same access, point the integration at its credential, then deactivate the old user account.
Which plans include service accounts?
Every plan: Team, Professional, Enterprise and Signature. Only Administrators can create and manage them.
Last verified: 21 Oct 2026, against www.smartsuite.com/features/service-accounts and www.smartsuite.com/pricing (plan availability). Setup steps, roles, credential types and expiration reminders are from the Support draft of 21 Oct 2026.