> For the complete documentation index, see [llms.txt](https://docs.podigee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.podigee.com/documentation/grow-and-monetize/monetization/create-service-access.md). # Create service access Create a limited service identity for an approved integration without exposing a secret in the user interface. Use service access when an approved automation must call a Podigee Ad Server integration without using a person's sign-in. Podigee creates a separate service identity, limits its actions to the selected scope, and records the exact integration version used for the request. The technical term for this identity is a service principal. You do not need to manage the identity as a team member. It is separate from the human access directory. ## Before you start * You have permission to create service access in the workspace. * An integration connector exists and has a current version. * You know which automation needs access and which actions it must perform. * You know the smallest workspace scope that can complete the job. * You have an approved secret store for the credential reference. If no integration appears in the action, create or repair the connector first. Podigee does not create service access against a missing, stale, or unverified integration version. ![The One Podigee Add flight form shows the delivery destination and the choice between Podigee delivery and a connected demand provider.](https://2032417310-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbqUKO6lljHGzkEAzliPI%2Fuploads%2Fgit-blob-5fc4e4d261a5d8c83f52f4569ec7dfeb55c32a06%2Fdoc-monetization-034-add-flight.jpg?alt=media) *Choose a connected provider only when its connection has passed the required checks.* ## Create the service access 1. Open **Monetization > Revenue jobs**. 2. Open **Integration certification**. 3. Select **Create service access**. 4. Select the current integration version in **Where this applies**. 5. Enter an **Access name** that describes the automation. Use a name such as `report-exporter` or `delivery-monitor`. 6. Open **Allowed actions**. 7. Select only the actions that the automation needs. 8. Select the workspace in **Access scope**. 9. Set **Access expires** when the access is temporary or belongs to a partner. 10. Enter a short reason that explains the business purpose. 11. Select **I reviewed these details and authorize this action**. 12. Select **Start**. The action runs in the background. Podigee checks the integration version, permission list, scope, and expiry before it creates anything. The action does not need a second reviewer. ## Check the result 1. Open **Monetization > Operations**. 2. Open the service access operation. 3. Confirm that the operation is complete. 4. Check the integration version, access scope, allowed actions, expiry, and issuance receipt. 5. Give the automation only the credential reference from the approved secret process. The result contains the service identity, role, allowed actions, scope, credential version, key identifier, and issuance receipt. The result does not display a secret. Do not copy a secret into a ticket, report, URL, or chat message. ## Change or remove access safely Create a new service access request when the automation needs a different action, scope, or credential profile. Keep the old record so you can explain earlier requests. Use the expiry date for temporary access. Ask a workspace administrator to revoke access when the automation or partner no longer needs it. Do not delete the operation record to hide a failed or expired request. ## If the request is blocked * **No eligible item yet:** create or repair the integration connector, then return to the action. * **Permission not approved:** remove the action or ask a workspace owner to approve it. * **Scope is invalid:** select a scope inside the current workspace. * **Expiry is invalid:** choose a future date or leave the field empty. * **Integration changed:** open the current integration version and submit the request again. * **Credential receipt is invalid:** do not retry with different values. Contact your workspace administrator or Podigee Support with the operation reference. ## Expected result The automation has a separate, limited identity. Its access is bound to the selected workspace, integration version, actions, and lifetime. Human sign-in access and the service access record stay separate, and the audit record remains available for later review. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.podigee.com/documentation/grow-and-monetize/monetization/create-service-access.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.