Automation access

Give tools access to one project and only the operations they need.

Choose an identity

• Personal scoped key: local tooling acting within your current project access.
• Service account: shared automation with its own project permissions, rather than a teammate's identity.
• GitHub connection: an approved workflow uses short-lived access as a service account instead of a stored Metalhost key.

Create a metrics scraper key

1. Select the project, then open Developers → Service accounts.
2. Create an account named, for example, grafana-reader. Choose the metrics-reader permissions or select only monitoring.read.
3. Open its credentials and create a key with a descriptive name and expiry.
4. Copy the one-time secret directly to your secret manager or Grafana's secure header configuration.
5. Confirm you saved it. Test a read before relying on the integration.

A key cannot exceed the account's current grants. New keys default to 90 days and have a maximum lifetime of one year. API keys are not SSH keys and do not provide a guest shell.

Permissions

Separate read/write capabilities cover compute, storage, backups, networking and monitoring. Project and catalog access are read-only capabilities. monitoring.read reads charts and exports; monitoring.write manages alerting and guest-monitoring enrollment. Compute writes can create charges or delete resources. Grant reads explicitly when your integration also needs to list or inspect resources.

Scoped credentials cannot create identities or mint more credentials, open consoles, or bypass project boundaries. A permission template is a starting point, not a reason to grant everything.

Rotate without losing access

1. Choose rotation on the existing credential. Select no overlap for a compromised key, or a bounded overlap (at most 24 hours) for a planned migration.
2. Save the new secret immediately. No overlap invalidates the previous key immediately.
3. Replace the consumer's secret and verify its requests succeed.
4. Let the overlap end or revoke the old credential earlier after all consumers have moved.

Disable and revoke

Disable a service account to block its automation access; revoke a credential or delete a GitHub connection when that access should not return. Do not assume a temporary disable is permanent revocation. Plan credential replacement before deleting an identity used by CI or monitoring.

Project-wide incident containment is a separate staff operation, not an automatic consequence of every personal password reset. Contact support if an incident may involve service accounts or workflow connections, and identify the affected project.

GitHub workflows

Use the GitHub Actions guide for verification and a complete workflow. This gives an existing job API access; it does not supply managed runners.