What's New

Introducing IBM Cloud IAM Service IDs and API Keys

Share this post:

IBM Cloud Identity & Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently on the IBM Bluemix Platform.  Starting in September 2017, you can authenticate your applications or services by using service IDs.

What is a Service ID?

A service ID is an identity that can be used by an application or service. Imagine that a group of developers work on an application together. The application needs the ability to call APIs of several services in the IBM Bluemix Platform. None of the developers would wish to use their personal identities and API keys to access those services from the shared application as that would expose their personal credentials to their co-developers. The developers may also wish to use a credential that has access only to the services needed by the application rather than using a credential that authenticates them as a user who has broader access. Service IDs are ideal for this purpose. The developers can create a service ID and an API key that can be used to authenticate as the service ID. They can then grant the service ID access to only the services the application requires, and then use the service ID’s API key from the application to authenticate as the service ID.

Why use Service IDs?

  • Users can keep their personal credentials private
  • The service ID can be granted access only to the minimum set of services required; loss of the API key would not give access to everything the user has access to
  • Each application can have its own service ID and API key, allowing for easy rotation of one key without impacting other applications or users
  • If desired, a unique key can be used for each service so that an untrusted service cannot gain access to other resources
  • Since service IDs are not tied to a specific user, if a user leaves an organization and is deleted from the account, the service ID remains ensuring that your application or service stays up and running


How do I use Service IDs and API Keys?

To create a service ID, navigate to Manage->Security->Identity & Access. Then, select Service IDs from the left navigation menu.


Click Create. You’ll be prompted to give the Service ID a name and description. Choose values that will be meaningful to you and will help you identify what you use this service ID for when working in the UI.


Once you click Create, your service ID is displayed.

In order for this service ID to have permissions to call APIs, you need to assign a policy to it.


After you have assigned a policy to the service ID to give it permission to call APIs, you must create at least one API key for the service ID to enable an application to authenticate as this identity. In the Actions menu for the service ID, select Manage service ID.


On the Manage Service ID page under the API keys section, click Create.


You are prompted to give the API key a name and description. Again, choose a name and description that will help you remember what the key is used for.


The key is generated and you can select to download it in a file or show it on the screen, which will allow you to cut and paste it into your application. You must save the key at this time because you cannot display it again. If you lose the key, you will need to delete that key and create a new one.


The API key should be protected as you would protect a password. Anyone who obtains the API key can perform any action or access any resource that the service ID’s policies allow. It is recommended that API keys be rotated at regular intervals. To rotate your key, create a new API key, modify your application to use the new key, and then delete the old API key. It is possible for one service ID to have multiple active API keys, which enables you to rotate keys without disruption.
From the application, you can now use the POST /oidc/token call to exchange the API key for a temporary token that will be used for API calls. It is also possible to use the API key directly in API calls, but it is strongly recommended for better security that you use a token to reduce the chances of anyone learning your API key.

To learn more

IBM Cloud Identity and Access Management Architect

Add Comment
No Comments

Leave a Reply

Your email address will not be published.Required fields are marked *

More What's New stories

IBM Now Offers SAP on IBM Cloud in Partner-Managed Business Model

Building on a 46-year alliance with SAP, the IBM Cloud platform has been certified by SAP for its bare metal servers, local and shared storage and networking. This certification allows our Business Partners to run their client’s full production SAP applications and associated workloads on the IBM Cloud and manage it.

Continue reading

Streaming Analytics: New features and new price plans

The Streaming Analytics service in the IBM Cloud is an advanced analytic platform allowing user-developed applications to quickly ingest, analyze, and correlate information as it arrives from a wide variety of real-time data sources. Today, a new version of the service is generally available, providing a set of exciting new features and new set of price plans.

Continue reading

Go Lite with Watson Knowledge Studio

Watson Knowledge Studio (WKS) is now available with a Lite Plan, as part of IBM Cloud's Lite Accounts that never expire and don't need payment information. If you are involved with analyzing text data and have never used WKS or if you had signed up to use the Free Plan of WKS on IBM Cloud, you should read this!

Continue reading