Reference
crab service-account
Manage organization-scoped OIDC workload and opaque-token service accounts. These identities access the managed API and receive only bounded repository transfer grants; they do not expose permanent origin credentials.
Synopsis
crab service-account [OPTIONS] <COMMAND>Common options
| Option | Default | Description |
|---|---|---|
--service <AUTHORITY> | Active profile | Target an exact installed managed-service authority |
--json | false | Emit one structured JSON envelope; secrets appear only for create-token and rotate |
Commands
list
crab service-account list [OPTIONS] <ORGANIZATION>crab service-account list acme --jsonList output never contains an opaque token secret.
create-workload
crab service-account create-workload [OPTIONS] \
--role <ROLE> \
--issuer <ISSUER> \
--subject <SUBJECT> \
<ORGANIZATION> <NAME>crab service-account create-workload acme release-ci \
--role writer \
--issuer https://token.actions.githubusercontent.com \
--subject 'repo:acme/models:ref:refs/heads/main'create-token
crab service-account create-token [OPTIONS] --role <ROLE> <ORGANIZATION> <NAME>| Option | Default | Description |
|---|---|---|
--expires-in-seconds <SECONDS> | 2592000 | Requested credential lifetime |
crab service-account create-token acme release-ci \
--role writer \
--expires-in-seconds 2592000 \
--jsonThe token is returned exactly once. Capture it directly into an approved secret store and prevent command stdout from entering logs.
rotate
crab service-account rotate [OPTIONS] \
--revision <REVISION> \
<ORGANIZATION> <ACCOUNT_ID>| Option | Default | Description |
|---|---|---|
--expires-in-seconds <SECONDS> | 2592000 | Requested replacement lifetime |
--overlap-seconds <SECONDS> | 0 | Bounded old/new credential overlap |
crab service-account rotate acme 018f3f80-7b2d-7c3a-8b1f-a0b1c2d3e4f5 \
--revision 2 \
--overlap-seconds 300 \
--jsonThe replacement token is also shown exactly once.
revoke
crab service-account revoke [OPTIONS] --revision <REVISION> <ORGANIZATION> <ACCOUNT_ID>crab service-account revoke acme 018f3f80-7b2d-7c3a-8b1f-a0b1c2d3e4f5 \
--revision 3