> ## Documentation Index
> Fetch the complete documentation index at: https://docs.encord.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Service Integrations

A service integration holds a key pair that Encord uses to sign short-lived tokens (JWTs) on behalf of your Workspace. The private key never leaves Encord. The public key is published so the system receiving the token can check that Encord signed it.

You use service integrations for:

* **Workload Identity Federation (WIF) with cloud storage.** Encord connects to your [Azure](https://docs.encord.com/platform-documentation/General/annotate-data-integrations/annotate-azure-blob-integration.md), [GCP](https://docs.encord.com/platform-documentation/General/annotate-data-integrations/annotate-gcp-integration.md), or [AWS S3](https://docs.encord.com/platform-documentation/General/annotate-data-integrations/annotate-aws-integration.md) storage without any keys, secrets, or SAS tokens.
* **Your own endpoints.** For example, [custom embedding models](https://docs.encord.com/platform-documentation/Curate/custom-embedding-models.md).

## How Workload Identity Federation Works

With WIF, your cloud provider trusts Encord as an identity provider, instead of trusting a key or secret that you share with Encord.

1. You create a service integration in Encord.
2. In your cloud account, you configure Encord's issuer URL as a trusted identity provider, and allow only one subject: `service-integration:<service integration UUID>`.
3. Each time Encord needs to access your storage, it signs a short-lived token with the service integration's private key and exchanges it with your cloud provider for temporary credentials.
4. Your cloud provider checks the token's signature against Encord's published public keys, and checks the issuer, subject, and audience against what you configured.

No secret is exchanged in either direction. You can revoke Encord's access at any time from your own cloud account, without contacting Encord: remove the federated credential, identity provider, or role binding you created.

> [!NOTE]
>
> Credentials and signed URLs that were already issued stay valid until they expire. Cloud credentials normally expire within an hour, but signed URLs can stay valid for up to 7 days. To cut off access immediately, also remove the identity's access to your storage.

### Issuer URL

Encord's issuer URL depends on your Encord deployment:

| Deployment | Issuer URL |
| - | - |
| Global / EU (`app.encord.com`) | `https://api.encord.com/v2/public/organisation/<Workspace UUID>/service-integrations` |
| US (`app.us.encord.com`) | `https://api.us.encord.com/v2/public/organisation/<Workspace UUID>/service-integrations` |

The integration form in Encord shows the exact issuer URL for your Workspace, with a copy button. Always copy it from there.

## Create a Service Integration for Cloud Storage

> [!NOTE]
>
> Only Workspace Admins can create service integrations. If **Service integrations** does not appear in your Workspace settings, contact Encord to enable it for your Workspace.

1. In Encord, go to [Workspace Settings](https://docs.encord.com/platform-documentation/General/general-workspace-settings.md#workspace-settings) and select **Service integrations**.

2. Click **New service integration**.

3. Give the service integration a meaningful **Title**. For example, `Azure WIF - production storage`.

4. Under **Used for**, select the cloud provider you are connecting: **Azure**, **GCP**, or **AWS**.

   Encord sets the signing algorithm to **ES256** and fills in the target domain for that provider. You do not need to enter either.

5. Click **Create service integration**.

The service integration appears in the list with its UUID. You choose it by name when you create the cloud integration.

> [!TIP]
>
> Create one service integration for each cloud integration. Your cloud provider trusts a single service integration UUID, so keeping them separate lets you revoke access to one bucket or storage account without affecting the others.

You can now create the cloud integration:

* [Azure Blob](https://docs.encord.com/platform-documentation/General/annotate-data-integrations/annotate-azure-blob-integration.md#set-up-workload-identity-federation)
* [GCP](https://docs.encord.com/platform-documentation/General/annotate-data-integrations/annotate-gcp-integration.md#2b-set-up-workload-identity-federation)
* [AWS S3](https://docs.encord.com/platform-documentation/General/annotate-data-integrations/annotate-aws-integration.md#3b-create-a-role-using-workload-identity-federation)

## Create a Service Integration for Your Own Endpoint

Select **Encord Custom** under **Used for** to create a service integration for your own service.

| Field | Description |
| - | - |
| **Title** | A meaningful name. |
| **Target domain** | The origin of your endpoint, including `https://`. This is the token's `aud` claim. |
| **Signing algorithm** | **EdDSA (Ed25519)** is the default. Choose **ES256 (ECDSA P-256)** only if the service receiving the token does not accept EdDSA. |

See [Custom embedding models](https://docs.encord.com/platform-documentation/Curate/custom-embedding-models.md) for a complete example.

## Limitations

* A cloud integration only accepts a service integration created for the same provider. For example, an Azure integration cannot use a service integration created for GCP.
* Cloud storage token exchanges only accept ES256 keys. Encord sets this for you when you select a cloud provider under **Used for**.

## Delete a Service Integration

To delete a service integration, click the delete icon next to it and confirm.

> [!WARNING]
>
> Deleting a service integration breaks every cloud integration that uses it. Encord can no longer sign tokens for those integrations, so their data stops loading.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.