Skip to main content
Gateway service accounts are identities used to authenticate clients connecting to Conduktor Gateway.

​
Two types of service accounts

Gateway supports two types of service accounts, each suited for different use cases: Local service accounts
  • Created and managed entirely within Gateway using the admin API
  • No external identity provider required
  • Gateway generates credentials with configurable time-to-live
  • Ideal for sharing data with external partners without managing a separate identity provider
  • Only available in Gateway-managed authentication mode
External service accounts
  • Managed by external identity providers (OIDC, mTLS certificates)
  • Can be mapped to friendly names in Gateway for better readability
  • Original identity from provider (like Azure UUID) is preserved but aliased
  • Used when integrating with existing enterprise identity systems
  • Works in both Gateway-managed and Kafka-managed modes

​
Benefits

  • Flexible identity management: choose between self-managed or provider-managed identities
  • Simplified access control: apply ACLs and Interceptors using friendly names
  • Audit trail: all service account activity logged in Gateway audit logs
  • Virtual Cluster association: link service accounts to specific Virtual Clusters for multi-tenancy