NetNXT Logo

How to create GitHub service account in Twingate

May 5, 2026
3 min read
ByVed Sharma

Purpose

This guide explains how to create a Twingate Service Account and securely connect GitHub Actions workflows to private internal resources using a Service Key. This helps automate CI/CD access without requiring browser-based login or user interaction.

Prerequisites

  • Admin access to your Twingate Admin Console

  • Existing Twingate network configured

  • Access to the target private resources (servers, databases, internal services)

  • GitHub repository admin access

  • Permission to manage GitHub Actions secrets

Step-by-Step Instructions

Step 1 — Log in to Twingate Admin Console

  • Open your Twingate admin URL
    Example: https://[your-network].twingate.com/admin

  • Sign in using your administrator account

This gives you access to create and manage Service Accounts.

Step 2 — Navigate to Service Accounts

  • In the left sidebar, click:

Team → Service Accounts

This section allows you to manage non-human identities used for automation and CI/CD workflows.

Step 3 — Create a New Service Account

  • Click + Add Service Account

  • Enter a descriptive name such as:

    • github-actions

    • github-ci

    • deploy-server

    • automation-bot

Use clear naming so future management becomes easier.

Step 4 — Assign Required Resources

  • Select the specific Resources this Service Account should access

Examples:

  • Internal application servers

  • Private databases

  • Development environments

  • Backend APIs

Best Practice

Apply the Principle of Least Privilege

Only grant access to the exact resources required. Avoid broad access to reduce security risks.

Step 5 — Generate the Service Key

  • After creating the account, click Generate Service Key

This key is used by GitHub Actions to authenticate with Twingate.

Important

  • Copy the key immediately

  • Store it securely

The key will only be shown once. If lost, you must generate a new one.

Step 6 — Add the Service Key to GitHub Secrets

  • Open your GitHub repository

  • Navigate to:

Settings → Secrets and variables → Actions

  • Click New repository secret

  • Create a secret such as:

TWINGATE_SERVICE_KEY

  • Paste the generated Service Key

This ensures secure authentication without exposing credentials in workflow files.

Step 7 — Configure Your GitHub Actions Workflow

Use the following GitHub Action in your workflow YAML file:

- name: Connect to Twingate
  uses: twingate/github-action@v1

  with:
    service-key: ${{ secrets.TWINGATE_SERVICE_KEY }}

This allows your GitHub workflow to securely connect to internal resources through Twingate.

Expected Result / Validation

After successful configuration:

  • GitHub Actions can access private internal resources

  • No browser login is required

  • Authentication happens securely using the Service Key

  • CI/CD pipelines can deploy, test, or connect to internal systems automatically

Troubleshooting & FAQ

Service Key is lost

Twingate does not show the key again after creation.

Fix: Generate a new Service Key and update the GitHub Secret.

Workflow cannot access internal resources

This usually happens when the Service Account lacks resource permissions.

Fix: Review assigned Resources in Twingate and ensure required access is granted.

Authentication fails in GitHub Actions

This may happen if the secret name is incorrect.

Fix: Verify that the workflow uses the exact same secret name configured in GitHub.

Access is too broad

Avoid assigning unnecessary resources.

Fix: Follow least-privilege access and limit permissions to only required systems.

References

FAQ

1) How do I create a Twingate Service Account for GitHub Actions?

Log in to the Twingate Admin Console, go to Team → Service Accounts, create a new account, assign resources, and generate a Service Key.

2) Where should I store the Twingate Service Key for GitHub workflows?

Store the Service Key in GitHub repository Secrets under Settings → Secrets and variables → Actions for secure workflow authentication.

3) Why should I use least privilege when assigning Twingate resources?

Least privilege limits access only to required internal resources, reducing security risks if the service account or workflow is compromised.

4) How do I connect GitHub Actions to Twingate using the Service Key?

Use the Twingate GitHub Action in your workflow YAML and reference the stored secret using service-key: ${{ secrets.TWINGATE_SERVICE_KEY }}.

5) Can I recover the Twingate Service Key after closing the window?

No. The Service Key is shown only once. If lost, you must generate a new key and update your GitHub secret.

Was this article helpful?