Service accounts

A service account is a superglue user that works only through its API key. Create one service account for each of your customers when your product runs superglue tools against your customers’ own accounts, such as their Ramp or Jira. Each service account holds only that customer’s connections, so a key never reaches another customer’s data.

What a service account can do

A service account key can:

Run the tools that the Service account role can view.
Create, read, update, and delete its own connections.
Connect a customer’s account through OAuth with one of your organization’s OAuth apps.

A service account cannot log in, use the agent or MCP, read run history, change tools, or see other users’ connections.

Set up access

Create the tools your customers use. All service accounts share them. Note the system ID that each tool uses, for example jira.
Create your first service account. This adds the Service account role to Access Rules.
In Access Rules, open the Service account role. Grant Viewer on each tool that service accounts need. Viewer lets a service account use a tool without changing it.

These grants apply to every service account, including ones you create later.

Create a service account

Admins can create a service account in two ways:

On Organization, open the Invite users menu and choose Create service account.
With the API and an admin API key:

curl -X POST https://api.superglue.cloud/v1/service-accounts \
  -H "Authorization: Bearer <admin-api-key>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Acme Inc" }'

The response contains data.serviceAccount.id and data.apiKey.

Self-hosted deployments use their own API and web app URLs in place of api.superglue.cloud and app.superglue.cloud.

Connect a customer’s account

With OAuth

Add your OAuth app to superglue. Create a connection of your own for the system ID with your app’s client ID, client secret, authorization URL, token URL, and scopes. superglue saves the client ID and secret as an organization OAuth app, listed on the Connections page under OAuth apps. In the provider’s app settings, add https://app.superglue.cloud/api/auth/callback as a redirect URI. Skip this step when the system uses a superglue managed OAuth app.
Get the app ID with GET /v1/oauth-apps?systemId=<system-id>.

When the customer clicks connect in your product, start the connection with the customer’s API key:

curl -X POST https://api.superglue.cloud/v1/oauth/exchanges \
  -H "Authorization: Bearer <customer-api-key>" \
  -H "Content-Type: application/json" \
  -d '{ "systemId": "<system-id>", "oauthAppId": "<oauth-app-id>" }'

Open data.authorizationUrl in a popup right away. The link expires after 5 minutes.
The customer approves access with the provider. superglue stores the tokens on the customer’s connection and closes the popup.
Check the connection with GET /v1/connections?systemId=<system-id> and the customer’s API key. The customer is connected when credentialKeys contains access_token with hasValue: true.

superglue refreshes the tokens when they expire. To reconnect a customer, repeat these steps.

With an API key or token

Collect the customer’s secrets in your product and store them with the customer’s API key. This example stores a Jira email and API token:

curl -X POST https://api.superglue.cloud/v1/connections \
  -H "Authorization: Bearer <customer-api-key>" \
  -H "Content-Type: application/json" \
  -d '{
    "systemId": "jira",
    "name": "Acme Jira",
    "url": "https://acme.atlassian.net",
    "authentication": { "type": "api_key" },
    "credentials": { "email": "it@acme.com", "api_token": "<customer-api-token>" }
  }'

Use the system ID and secret names that your tools use. url is this customer’s own address, for example their Jira site. data.credentialKeys lists each secret name with hasValue. To change a secret later, send PATCH /v1/connections/<connection-id> with only the changed values in credentials.

Run tools

Run a tool with the customer’s API key. The run uses that customer’s connection.

curl -X POST https://api.superglue.cloud/v1/tools/<tool-id>/run \
  -H "Authorization: Bearer <customer-api-key>" \
  -H "Content-Type: application/json" \
  -d '{ "inputs": { "fromDate": "2026-09-01", "toDate": "2026-09-30" } }'

The response contains status, data, and error. Save the result. A service account cannot read past runs.

For long runs, add "options": { "async": true, "webhookUrl": "https://<your-endpoint>" } to the body. superglue posts the finished run to your URL.

Delete a service account

Delete a service account from Organization, or with an admin API key:

curl -X DELETE https://api.superglue.cloud/v1/service-accounts/<service-account-id> \
  -H "Authorization: Bearer <admin-api-key>"

This also deletes its API key and all of its connections.