How to Configure Twingate Service Accounts for Headless Access?

Overview

Service Accounts allow non-human entities (like CI/CD pipelines, GitHub Actions, or backend servers) to access Twingate Resources without a user interface or browser based login. This is often used to let a cloud build server deploy code to a private on-prem database.

Step 1: Create the Service Account

1. Log in to the Twingate Admin Console.

2. Navigate to Team > Service Accounts.

3. Click Create Service Account.

   • Name: e.g., Jenkins-Build-Server.

   • Resource Access: Assign the specific Resources this bot needs (e.g., 10.0.5.20 or *.dev.netnxt.local).

4. Generate Key: Click Generate Key. This will download a JSON file (e.g., service_key.json).

   • Security Warning: Store this key securely (e.g., in AWS Secrets Manager or Vault). If lost, you must generate a new one.

Step 2: Deploy in "Headless" Mode (Linux)

On the server that needs access:

1. Install Twingate:

curl -s https://binaries.twingate.com/client/linux/install.sh | sudo bash

2. Setup & Start: Run the setup command pointing to your key file.

sudo twingate setup --headless /path/to/service_key.json
sudo twingate start

3. Verify Status:

twingate status

FAQ

1) What are Twingate Service Accounts used for?

Twingate Service Accounts provide non-human authentication for servers, scripts, and CI/CD pipelines to securely access private network resources without browser-based login.

2) How do you create a Service Account in Twingate?

Service Accounts are created in the Twingate Admin Console under Team > Service Accounts, where specific resources are assigned and an authentication key is generated.

3) What is headless mode in Twingate?

Headless mode allows Twingate to run on servers without a user interface, enabling automated access for build systems and backend services using service account credentials.

4) How do you deploy Twingate on a Linux server using a Service Account?

Install the Twingate client, run the setup command with the service account JSON key, and start the service to enable secure automated connectivity.

5) Is the Twingate service account key reusable across multiple servers?

Yes, but it is recommended to create separate service accounts for different servers or applications to maintain better security and audit control.