As Looker continues to evolve, we wanted to share upcoming changes to how API credentials and automated workflows are managed. These updates are designed to expand our security capabilities, improve the auditability of your instance, and further align Looker’s authentication model with industry standards.
Starting in January 2026 with Looker version 26.0, we are introducing Service Accounts for Looker (original). This new functionality will separate human users from machine users, providing a secure, dedicated identity for applications. This new service account user type will become the standard for all API-based integrations and automated workflows.
Note: Service Accounts are already available and remain the standard for Looker Core on Google Cloud instances.
The Roadmap: What to Expect
Today, customers may be using API keys attached to “dummy” users, or artificial users with no true login or password. As part of this launch, customers should plan to migrate these “dummy users” to Service Accounts. To provide ample time for migration and testing, we are rolling out these changes in two phases.
Phase 1: Launch of Service Accounts (January 2026 in Looker version 26.0)
-
New Feature: Admins can now create Service Accounts in the Users panel.
-
Migration Tools: We are introducing features to help you identify potential “dummy users” (e.g., users with no IDP login or password) and easily migrate them to Service Accounts.
-
Action Required: Begin auditing your user list and migrating any API-only workflows to the new Service Accounts.
Phase 2: Security Enforcement & Deprecation (April 20, 2026)
-
Deprecation: 90 days after the launch of Service Accounts, Admins will no longer be able to manage API credentials for standard users.
-
Admins will only manage credentials for Service Accounts.
-
Standard users will be solely responsible for creating, viewing, and deleting their own API credentials.
-
-
Goal: This ensures that a human user’s credentials are known only to that user, eliminating the risk of undetectable or traceable Admin impersonation.
Best Practices for the Transition
To ensure a smooth transition and avoid disruptions, we recommend adopting the following best practices immediately:
- Audit and Migrate Early: Do not wait. Use the new identification tools in the Admin panel to find users that look like service accounts (e.g., names like “Looker Bot” or “Embed User”). Migrate these to official Service Accounts during Phase 1.
Note: Migration is not reversible for that specific user entity, so ensure the account is indeed a machine user before converting.
- Adopt a “Least Privilege” Model: Service Accounts are the perfect opportunity to tighten security. Since these accounts are often used for specific tasks (like rendering a dashboard for an embed), ensure they are granted only the permissions required for that specific task, rather than blanket Admin privileges.
Next Steps
The ability to create Service Accounts will appear in your instance in January 2026 as part of the 26.0 release. We encourage all administrators to start moving their API automations to this new, more secure standard as soon as possible.
By migrating to Service Accounts, you aren’t just “keeping the lights on”—you are actively securing your data ecosystem and ensuring that every action in Looker is properly authenticated and attributable.
