Create a service account and API key

Customer applications should normally call P6M with a service account API key. Do not put platform tokens in customer apps.

Create a service account

Use the customer portal:

1. Open Users.
2. Open the Services tab.
3. Click New service account.
4. Name it after the app or backend, for example web-api-sa.

Service accounts should be clearly named. P6M recommends a -sa suffix.

Grant access

Open Users and Access, then add a role grant for the service account. Choose the narrowest role and scope that works for the app.

For example, an app that writes metadata and sends notifications might need:

• metadata:*
• notification_endpoints:*
• notifications:*

Create the API key

Open API Keys and create a key for the service account. Copy the key immediately; it will not be shown again.

Use it in your backend:

curl "$P6M_URL/v1/metadata?orgId=$ORG_ID&enabledServiceId=$METADATA_SERVICE_ID" \
  -H "Authorization: Bearer $P6M_API_KEY"

Rotate API keys periodically and when a deployment system, developer laptop, or CI secret may have been exposed.

What is charged

Identity and auth usage is charged around lifecycle and access-management activity rather than every login screen view:

• creating or updating user identities
• creating service accounts
• creating role grants
• creating Org or user API keys
• gateway/control-plane request processing for authenticated customer API traffic

Portal navigation by a signed-in human should not be treated as customer billable domain usage. Customer API calls made by apps and automation are the traffic that should be metered.