A service account is an RSA keypair scoped to a tenant. The private half lives in the JSON file that CLUTCHCALL_CREDENTIALS points at. You register the public half with the gateway through the methods on this page.
There is no SDK wrapper. Use the raw RPC envelope to call these methods.

​
PublishServiceAccount

Register a new public key for a tenant. For rotation, you can also add a new key next to an existing key. Returns Empty. Multiple keys can coexist for one tenant. This is useful for rolling rotations.

​
RevokeServiceAccount

Remove a key. The gateway stops accepting JWTs signed with the matching kid. The gateway closes each in-flight QUIC connection authenticated with that kid within ~1 RTT. Returns Empty.

​
SessionAuth

Mint a short-lived browser-scoped JWT from an existing service account. Use this method to give a token to a frontend (e.g. the TypeScript SDK in browser mode). The frontend never sees the service-account private key. Request (SessionAuthRequest): Response (SessionAuthResponse): The gateway pins the issued token to the requesting tenant’s origin (the Origin header sent during the WebTransport handshake). You cannot redirect a token issued for tenant_a to tenant_b’s gateway URL.

​
Rotation pattern

  1. Call PublishServiceAccount with the new private_key_id. Both keys are now valid.
  2. Update every host that runs the SDK to use the new private key.
  3. Wait until all in-flight tokens signed with the old key expire (≤ 1 hour by default).
  4. Call RevokeServiceAccount for the old private_key_id.
Every active call continues to run through the rollover.