Trestle
Machine identity

Service accounts

Give each trusted workload its own copy-once bearer secret, explicit scopes and independently revocable identity.

Create in the dashboard

Open Integrations → Credentials, choose Service account, name the workload and enter comma-separated scopes such as records:read,records:write. Copy the returned secret immediately; only its hash persists.

Use from a server

curl "$TRESTLE_URL/api/v1/collections/issues/records?limit=25" \
  -H "Authorization: Bearer $TRESTLE_SERVICE_TOKEN"

Operational pattern

  1. Create separate credentials for development, staging and production.
  2. Grant only the scopes and collection rules the workload needs.
  3. Deploy the secret through the platform’s secret manager.
  4. Rotate by creating and deploying a replacement before revoking the old credential.
  5. Review last-used metadata and revoke abandoned identities.

Never embed a service credential in browser JavaScript, mobile application packages or public CI logs.

Provider storage

Scoped service accounts and personal tokens behave identically on both providers; token hashes, scope checks, expiry and revocation are provider-neutral and exercised by the provider-parameterized identity suite.