What's New

Introducing IBM Cloud IAM Service IDs and API Keys

Share this post:

IBM Cloud Identity & Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently on the IBM Bluemix Platform.  Starting in September 2017, you can authenticate your applications or services by using service IDs.

What is a Service ID?

A service ID is an identity that can be used by an application or service. Imagine that a group of developers work on an application together. The application needs the ability to call APIs of several services in the IBM Bluemix Platform. None of the developers would wish to use their personal identities and API keys to access those services from the shared application as that would expose their personal credentials to their co-developers. The developers may also wish to use a credential that has access only to the services needed by the application rather than using a credential that authenticates them as a user who has broader access. Service IDs are ideal for this purpose. The developers can create a service ID and an API key that can be used to authenticate as the service ID. They can then grant the service ID access to only the services the application requires, and then use the service ID’s API key from the application to authenticate as the service ID.

Why use Service IDs?

  • Users can keep their personal credentials private
  • The service ID can be granted access only to the minimum set of services required; loss of the API key would not give access to everything the user has access to
  • Each application can have its own service ID and API key, allowing for easy rotation of one key without impacting other applications or users
  • If desired, a unique key can be used for each service so that an untrusted service cannot gain access to other resources
  • Since service IDs are not tied to a specific user, if a user leaves an organization and is deleted from the account, the service ID remains ensuring that your application or service stays up and running


How do I use Service IDs and API Keys?

To create a service ID, navigate to Manage->Security->Identity & Access. Then, select Service IDs from the left navigation menu.


Click Create. You’ll be prompted to give the Service ID a name and description. Choose values that will be meaningful to you and will help you identify what you use this service ID for when working in the UI.


Once you click Create, your service ID is displayed.

In order for this service ID to have permissions to call APIs, you need to assign a policy to it.


After you have assigned a policy to the service ID to give it permission to call APIs, you must create at least one API key for the service ID to enable an application to authenticate as this identity. In the Actions menu for the service ID, select Manage service ID.


On the Manage Service ID page under the API keys section, click Create.


You are prompted to give the API key a name and description. Again, choose a name and description that will help you remember what the key is used for.


The key is generated and you can select to download it in a file or show it on the screen, which will allow you to cut and paste it into your application. You must save the key at this time because you cannot display it again. If you lose the key, you will need to delete that key and create a new one.


The API key should be protected as you would protect a password. Anyone who obtains the API key can perform any action or access any resource that the service ID’s policies allow. It is recommended that API keys be rotated at regular intervals. To rotate your key, create a new API key, modify your application to use the new key, and then delete the old API key. It is possible for one service ID to have multiple active API keys, which enables you to rotate keys without disruption.
From the application, you can now use the POST /oidc/token call to exchange the API key for a temporary token that will be used for API calls. It is also possible to use the API key directly in API calls, but it is strongly recommended for better security that you use a token to reduce the chances of anyone learning your API key.

To learn more

IBM Cloud Identity and Access Management Architect

More What's New stories
November 16, 2018

IBM Cloud Functions Adds Support for PHP 7.2

IBM Cloud Functions added support for PHP 7.1 last year, and with the release of 7.2, we are updating! With PHP 7.2 you can ensure better app performance.

Continue reading

November 8, 2018

Introducing More Flexibility and Control for IBM Cloud Account Management Services Access

IBM Cloud is excited to announce more flexibility and control for account management services like billing, user management, and global catalog. This update means that key account management functions can now be granted to other users in your account with IBM Cloud Identity and Access Management policies.

Continue reading

November 7, 2018

IBM Cloud Functions Adds Support for Ruby 2.5

IBM Cloud Functions is welcoming Ruby 2.5 as a natively supported programming language. Join the Serverless revolution and start building cloud-native apps.

Continue reading