How to use authorized keys

To authenticate as a service account and perform operations on its behalf, use an authorized key pair.

Prerequisites

Make sure that you, or the service account that you use on your behalf, is in a group that has the admin role within your tenant; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
Create a new service account if needed.

Install and configure the Nebius AI Cloud CLI.
Check that your project ID is saved in the Nebius AI Cloud CLI profile configuration:
cat ~/.nebius/config.yaml
Make sure that you, or the service account that you use on your behalf, is in a group that has the admin role within your tenant; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
Create a new service account if needed.

Get the ID of the service account for which you want to issue the key and save it to an environment variable:

export SA_ID=$(nebius iam service-account get-by-name \
  --name <service_account_name> \
  --format jsonpath='{.metadata.id}')

Install and configure the Nebius AI Cloud provider for Terraform.
Make sure that you, or the service account that you use on your behalf, is in a group that has the admin role within your tenant; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
Create a new service account if needed.

Install and initialize the Nebius SDK for Go.
Make sure that you, or the service account that you use on your behalf, is in a group that has the admin role within your tenant; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
Create a new service account if needed.

Get the ID of the service account for which you want to issue the key and save it to a variable:

serviceAccount, err := sdk.Services().IAM().V1().
    ServiceAccount().GetByName(
        ctx,
        &iam.GetServiceAccountByNameRequest{
            Name: "<service_account_name>",
        },
    )
if err != nil {
    return err
}
serviceAccountID := serviceAccount.GetMetadata().GetId()
if serviceAccountID == "" {
    return errors.New("service account ID is missing")
}
fmt.Println(serviceAccountID)

Install and initialize the Nebius SDK for Python.
Make sure that you, or the service account that you use on your behalf, is in a group that has the admin role within your tenant; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
Create a new service account if needed.

Get the ID of the service account for which you want to issue the key and save it to a variable:

service_account_service = ServiceAccountServiceClient(sdk)
service_account = await service_account_service.get_by_name(
    GetServiceAccountByNameRequest(name="<service_account_name>"),
)
service_account_id = service_account.metadata.id
print(service_account_id)

Install and initialize the Nebius SDK for JavaScript.
Make sure that you, or the service account that you use on your behalf, is in a group that has the admin role within your tenant; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
Create a new service account if needed.

Get the ID of the service account for which you want to issue the key and save it to a variable:

const serviceAccountService =
  new ServiceAccountService(sdk);
const serviceAccount = await serviceAccountService.getByName(
  GetServiceAccountByNameRequest.create({
    name: "<service_account_name>",
  }),
);
const serviceAccountId = serviceAccount.metadata?.id;
if (!serviceAccountId) {
  throw new Error("service account ID is missing");
}
console.log(serviceAccountId);

Creating a key pair

If you are using the CLI, this step is optional. If you use the nebius iam auth-public-key generate command in the next step, the CLI creates the key pair for you.

Create a key pair on your local machine:

openssl genrsa -out private.pem 4096 && \
openssl rsa -in private.pem -outform PEM -pubout -out public.pem

This command creates the public.pem and private.pem key files in your local directory where you run the command.

Uploading the public key

To upload an authorized key with Terraform or one of the SDKs, the provider or SDK must already be authenticated with an existing authorized key. You cannot upload the first authorized key for a service account using Terraform or an SDK. If you already have an authorized key, for example, one created with the CLI, proceed to update the configuration to use your existing authorized key with Terraform or the SDK.

In the web console, go to Administration → IAM.
Open the Service accounts tab.
Open the page of the required service account.
Click Upload authorized key.
Click Attach file and then select public.pem.
(Optional) Set an expiration date.
Click Upload key.

The key is displayed on the Authorized keys tab.

Depending on whether you already created a key pair, run one of the following commands:

To upload the public key if you already created a key pair:

nebius iam auth-public-key create \
  --account-service-account-id $SA_ID \
  --data "$(cat public.pem)"

To create a new key pair, upload the public key and create a local CLI configuration file in one step:

nebius iam auth-public-key generate \
  --service-account-id $SA_ID \
  --output ~/.nebius/$SA_ID-credentials.json

To set an expiration date for the key, add the --expires-at parameter to either command with a timestamp in ISO 8601 format, for example --expires-at 2026-04-01T20:00:00Z.After you complete either option, you can find the authorized key in the web console. In the sidebar, go to Administration → IAM → Service accounts, and select the service account for which you created the authorized key.

To upload a new authorized key with Terraform:

Inside the working directory, create a configuration file, for example main.tf:
resource "nebius_iam_v1_auth_public_key" "sa_authorized_key" { name = "sa_authorized_key" parent_id = "<project_ID>" account = { service_account = { id = "<service_account_ID>" } } data = file("${path.module}/public.pem") expires_at = "<expiration_date>" }
The resource contains the following parameters:
- parent_id: Project ID.
- account.service_account.id: ID of the service account. To copy the service account from the web console, go to Administration → IAM → Service accounts, next to the ID, click .
- data: Contents of the public.pem file that you created in the previous step. In the example above, Terraform reads the contents of public.pem with the file() function. You can also use trimspace(file(...)) to remove trailing whitespace.
- expires_at (optional): Date and time when the authorized key expires, in ISO 8601 format, for example 2026-04-01T20:00:00Z.
Check that the configuration is correct:
terraform validate
Apply the changes:
terraform apply

For all available arguments and attributes, see the full reference.

Upload the public key:

publicKeyData, err := os.ReadFile("public.pem")
if err != nil {
    return err
}
authPublicKeyService := sdk.Services().IAM().V1().
    AuthPublicKey()
authPublicKeyOperation, err := authPublicKeyService.Create(
    ctx,
    &iam.CreateAuthPublicKeyRequest{
        Spec: &iam.AuthPublicKeySpec{
            Account: &iam.Account{
                Type: &iam.Account_ServiceAccount_{
                    ServiceAccount: &iam.Account_ServiceAccount{
                        Id: "<service_account_ID>",
                    },
                },
            },
            Data: string(publicKeyData),
        },
    },
)
if err != nil {
    return err
}
authPublicKeyOperation, err = authPublicKeyOperation.Wait(ctx)
if err != nil {
    return err
}
authorizedKeyID := authPublicKeyOperation.ResourceID()
fmt.Println(authorizedKeyID)

In the code, set the following parameters:

Account.ServiceAccount.Id: ID of the service account for which you want to issue the key.
Spec.Data: Contents of public.pem that you created earlier.

After you complete this, you can find the authorized key in the web console. In the sidebar, go to Administration → IAM → Service accounts, and select the service account for which you created the authorized key.

Upload the public key:

public_key = Path("public.pem").read_text()
auth_public_key_service = AuthPublicKeyServiceClient(sdk)
auth_public_key_operation = await auth_public_key_service.create(
    CreateAuthPublicKeyRequest(
        spec=AuthPublicKeySpec(
            account=Account(
                service_account=Account__ServiceAccount(
                    id="<service_account_ID>",
                ),
            ),
            data=public_key,
        ),
    ),
)
await auth_public_key_operation.wait()
authorized_key_id = auth_public_key_operation.resource_id
print(authorized_key_id)

In the code, set the following parameters:

account=Account__ServiceAccount(id=...): ID of the service account for which you want to issue the key.
spec.data: Contents of public.pem that you created earlier.

Upload the public key:

const publicKey = readFileSync("public.pem", "utf8");
const authPublicKeyService =
  new AuthPublicKeyService(sdk);
const authPublicKeyOperation =
  await authPublicKeyService.create(
    CreateAuthPublicKeyRequest.create({
      metadata: ResourceMetadata.create({
        parentId: "<project_ID>",
      }),
      spec: AuthPublicKeySpec.create({
        account: Account.create({
          type: {
            $case: "serviceAccount",
            serviceAccount: Account_ServiceAccount.create({
              id: "<service_account_ID>",
            }),
          },
        }),
        data: publicKey,
      }),
    }),
  ).result;
await authPublicKeyOperation.wait();
const authorizedKeyId = authPublicKeyOperation.resourceId();
console.log(authorizedKeyId);

In the code, set the following parameters:

metadata.parentId: Project ID.
The service account for which you want to issue the key, via Account_ServiceAccount.create({ id: ... }).
spec.data: Contents of public.pem that you created earlier.

Updating the configuration

Update your configuration to use the authorized key you created:

If you used the web console to upload the public key, you do not need to update any additional configuration.

CLI
Terraform
Go SDK
Python SDK
JavaScript SDK

Create a new CLI profile:

Get the ID of the project that you want to work in and save it to an environment variable:
export PROJECT_ID=<project_ID>

Initialize the Nebius AI Cloud CLI configuration:

nebius profile create \
  --endpoint api.nebius.cloud \
  --service-account-file ~/.nebius/$SA_ID-credentials.json \
  --parent-id $PROJECT_ID \
  --profile <profile_name>

Check that your new profile has been created and set as default:
nebius profile list

Now you can run Nebius AI Cloud CLI commands on behalf of the service account. To do this, add --profile <service_account_profile_name> to the commands.

Configure the Nebius AI Cloud provider for Terraform to use an authorized key. Inside your Terraform working directory, add the service_account block to the provider configuration, for example in providers.tf:

provider "nebius" {
  service_account = {
    account_id       = "<service_account_ID>"
    public_key_id    = "<authorized_key_ID>"
    private_key_file = "<path_to_private_key>"
  }
}

In this configuration:

public_key_id: The ID of the authorized key that you uploaded. To copy the public key ID:
1. In the web console, go to Administration → IAM → Service accounts, and select the service account.
2. Click Authorized keys, and then click next to the ID of the public key you uploaded.
private_key_file: The path to the private.pem file you created in the previous step.

You can also pass these values through environment variables:

provider "nebius" {
  service_account = {
    account_id_env       = "SA_ID"
    public_key_id_env    = "AUTHKEY_ID"
    private_key_file_env = "AUTHKEY_PRIV_PATH"
  }
}

export SA_ID=<service_account_ID>
export AUTHKEY_ID=<authorized_key_ID>
export AUTHKEY_PRIV_PATH=<path_to_private_key>

Initialize the SDK using the authorized key you created:

newSdk, err := gosdk.New(
    ctx,
    gosdk.WithCredentials(
        gosdk.ServiceAccountReader(
            auth.NewPrivateKeyFileParser(
                nil,
                "<path_to_private_key>",
                "<authorized_key_ID>",
                "<service_account_ID>",
            ),
        ),
    ),
)
if err != nil {
    return err
}
defer newSdk.Close()

In the code, set the following parameters:

NewPrivateKeyFileParser’s second argument: Path to the private.pem file you created in the previous step.
NewPrivateKeyFileParser’s third argument: ID of the authorized key that you uploaded. To copy the ID:
1. In the web console, go to Administration → IAM → Service accounts, and select the service account.
2. Click Authorized keys, and then click next to the ID of the public key you uploaded.
NewPrivateKeyFileParser’s fourth argument: ID of the service account.

For more information about SDK initialization, see Initialization and authentication.

Initialize the SDK using the authorized key you created:

new_sdk = SDK(
    service_account_private_key_file_name="<path_to_private_key>",
    service_account_public_key_id="<authorized_key_ID>",
    service_account_id="<service_account_ID>",
)

In the code, set the following parameters:

service_account_private_key_file_name: Path to the private.pem file you created in the previous step.
service_account_public_key_id: ID of the authorized key that you uploaded. To copy the ID:
1. In the web console, go to Administration → IAM → Service accounts, and select the service account.
2. Click Authorized keys, and then click next to the ID of the public key you uploaded.
service_account_id: ID of the service account.

For more information about SDK initialization, see Initialization and authentication.

Initialize the SDK using the authorized key you created:

const newSdk = new SDK({
  credentials: new PkFileReader(
    "<path_to_private_key>",
    "<authorized_key_ID>",
    "<service_account_ID>",
  ),
});

In the code, set the following parameters:

PkFileReader’s first argument: Path to the private.pem file you created in the previous step.
PkFileReader’s second argument: ID of the authorized key that you uploaded. To copy the ID:
1. In the web console, go to Administration → IAM → Service accounts, and select the service account.
2. Click Authorized keys, and then click next to the ID of the public key you uploaded.
PkFileReader’s third argument: ID of the service account.

For more information about SDK initialization, see Initialization and authentication.

Nebius AI Cloud signup and payments

Identity and Access Management in Nebius AI Cloud

Overview of Nebius AI Cloud

Prerequisites

Creating a key pair

Uploading the public key

Updating the configuration

​Prerequisites

​Creating a key pair

​Uploading the public key

​Updating the configuration

Prerequisites

Creating a key pair

Uploading the public key

Updating the configuration