i-key <SERVICE_ACCOUNT_NAME> rotate <API_KEY_NAME>Running this command will create a new API key and invalidate the old one. The new API key is displayed as part of the command output and cannot be retrieved later. You can then use the new API key to connect your ZenML client to the server just as described above.

When rotating an API key, you can also configure a retention period for the old API key. This is useful if you need to keep the old API key for a while to ensure that all your workloads have been updated to use the new API key. You can do this with the --retain flag. For example, to rotate an API key and keep the old one for 60 minutes, you can run the following command:

zenml service-account api-key <SERVICE_ACCOUNT_NAME> rotate <API_KEY_NAME> \

--retain 60

For increased security, you can deactivate a service account or an API key using one of the following commands:

zenml service-account update <SERVICE_ACCOUNT_NAME> --active false

zenml service-account api-key <SERVICE_ACCOUNT_NAME> update <API_KEY_NAME> \

--active false

Deactivating a service account or an API key will prevent it from being used to authenticate and has immediate effect on all workloads that use it.

To keep things simple, we can summarize the steps:

Use the zenml service-account create command to create a service account and an API key.

Use the zenml connect --url <url> --api-key <api-key> command to connect your ZenML client to the server using the API key.

Check configured service accounts with zenml service-account list.

Check configured API keys with zenml service-account api-key <SERVICE_ACCOUNT_NAME> list.

Regularly rotate API keys with zenml service-account api-key <SERVICE_ACCOUNT_NAME> rotate.

Deactivate service accounts or API keys with zenml service-account update or zenml service-account api-key <SERVICE_ACCOUNT_NAME> update.

Important notice