Service accounts are now machine identities for the Speechify API

Speechify now has service accounts for API keys. A service account is a machine identity for a workload, not a person, so billing-sync, nightly-audio-renderer, or support-agent-runtime can own its own credentials and limits.

Personal keys are still useful for experiments. Service-account keys are the shape for production systems.

What does a service account change?

A service account owns one or more API keys and carries the scope ceiling those keys inherit. Tighten the service account and every inherited key gets tighter. Rotate a key and usage still rolls up to the same workload. Delete the service account and the whole credential family is revoked.

That gives you four things we wanted API credentials to have from day one:

• identity that survives a teammate leaving
• least-privilege scopes at the workload level
• usage attribution across rotation
• a clean revoke path when a system is retired

Key rotation without downtime

Service-account keys support zero-downtime rotation. Rotate the key, deploy the new secret, and let the old one expire after the grace window. If something leaked, set the grace window to 0 and cut over immediately.

That rotation call is also idempotent. Network retries should not mint surprise credentials.

Short-lived keys for agents

For AI agents and short-running jobs, a designated minter key can call POST /v1/auth/service-account-keys to mint a child credential with a required TTL and a weaker or equal scope set.

The rules are intentionally strict:

• a child key can never exceed the minter’s scopes
• it expires within 24 hours
• it cannot mint more keys
• spend and usage still roll up to the same service account

That last point matters. You can hand a call, job, or agent session a key that expires on its own without losing attribution.

Read the service accounts guide for the full setup flow.