How to create GitHub service account in Twingate

Purpose

This guide explains how to create a Twingate Service Account and securely connect GitHub Actions workflows to private internal resources using a Service Key. This helps automate CI/CD access without requiring browser-based login or user interaction.

Prerequisites

• Admin access to your Twingate Admin Console

• Existing Twingate network configured

• Access to the target private resources (servers, databases, internal services)

• GitHub repository admin access

• Permission to manage GitHub Actions secrets

Step-by-Step Instructions

Step 1 — Log in to Twingate Admin Console

• Open your Twingate admin URL
  Example: https://[your-network].twingate.com/admin

• Sign in using your administrator account

This gives you access to create and manage Service Accounts.

Step 2 — Navigate to Service Accounts

• In the left sidebar, click:

Team → Service Accounts

This section allows you to manage non-human identities used for automation and CI/CD workflows.

Step 3 — Create a New Service Account

• Click + Add Service Account

• Enter a descriptive name such as:

  • github-actions

  • github-ci

  • deploy-server

  • automation-bot

Use clear naming so future management becomes easier.

Step 4 — Assign Required Resources

• Select the specific Resources this Service Account should access

Examples:

• Internal application servers

• Private databases

• Development environments

• Backend APIs

Best Practice

Apply the Principle of Least Privilege

Only grant access to the exact resources required. Avoid broad access to reduce security risks.

Step 5 — Generate the Service Key

• After creating the account, click Generate Service Key

This key is used by GitHub Actions to authenticate with Twingate.

Important

• Copy the key immediately

• Store it securely

The key will only be shown once. If lost, you must generate a new one.

Step 6 — Add the Service Key to GitHub Secrets

• Open your GitHub repository

• Navigate to:

Settings → Secrets and variables → Actions

• Click New repository secret

• Create a secret such as:

TWINGATE_SERVICE_KEY

• Paste the generated Service Key

This ensures secure authentication without exposing credentials in workflow files.

Step 7 — Configure Your GitHub Actions Workflow

Use the following GitHub Action in your workflow YAML file:

- name: Connect to Twingate
  uses: twingate/github-action@v1

  with:
    service-key: ${{ secrets.TWINGATE_SERVICE_KEY }}

This allows your GitHub workflow to securely connect to internal resources through Twingate.

Expected Result / Validation

After successful configuration:

• GitHub Actions can access private internal resources

• No browser login is required

• Authentication happens securely using the Service Key

• CI/CD pipelines can deploy, test, or connect to internal systems automatically

Troubleshooting & FAQ

Service Key is lost

Twingate does not show the key again after creation.

Fix: Generate a new Service Key and update the GitHub Secret.

Workflow cannot access internal resources

This usually happens when the Service Account lacks resource permissions.

Fix: Review assigned Resources in Twingate and ensure required access is granted.

Authentication fails in GitHub Actions

This may happen if the secret name is incorrect.

Fix: Verify that the workflow uses the exact same secret name configured in GitHub.

Access is too broad

Avoid assigning unnecessary resources.

Fix: Follow least-privilege access and limit permissions to only required systems.

References

• Twingate Official Website

• GitHub Actions Documentation

FAQ

1) How do I create a Twingate Service Account for GitHub Actions?

Log in to the Twingate Admin Console, go to Team → Service Accounts, create a new account, assign resources, and generate a Service Key.

2) Where should I store the Twingate Service Key for GitHub workflows?

Store the Service Key in GitHub repository Secrets under Settings → Secrets and variables → Actions for secure workflow authentication.

3) Why should I use least privilege when assigning Twingate resources?

Least privilege limits access only to required internal resources, reducing security risks if the service account or workflow is compromised.

4) How do I connect GitHub Actions to Twingate using the Service Key?

Use the Twingate GitHub Action in your workflow YAML and reference the stored secret using service-key: ${{ secrets.TWINGATE_SERVICE_KEY }}.

5) Can I recover the Twingate Service Key after closing the window?

No. The Service Key is shown only once. If lost, you must generate a new key and update your GitHub secret.