# What confluent cloud service account permissions do I need to access schema registry

**URL:** <https://forum.confluent.io/t/what-confluent-cloud-service-account-permissions-do-i-need-to-access-schema-registry/37704>\
**Category:** Confluent Cloud\
**Created:** [25 April 2025 18:55 UTC](https://forum.confluent.io/t/what-confluent-cloud-service-account-permissions-do-i-need-to-access-schema-registry/37704 "2025-04-25T18:55:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![alberttwong](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/alberttwong/32/3910_2.png) [@alberttwong](https://forum.confluent.io/u/alberttwong)\
**Post date:** [25 April 2025 18:55 UTC](https://forum.confluent.io/t/what-confluent-cloud-service-account-permissions-do-i-need-to-access-schema-registry/37704/1 "2025-04-25T18:55:07Z")

</div>

There are 2 types of api keys - my (user) account and service account. When I use user account which gives you all the permissions, I can see my schema associated to my topic. However when I use service account, I can’t see the schema for my topic. What are the settings I need to see for my schema?

 ![Screenshot 2025-04-24 at 10.50.06 AM](https://us1.discourse-cdn.com/flex019/uploads/confluentcommunity/original/2X/1/1ce1ff67432641e35121fbb48edc0a1309f5bac8.png)

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [27 April 2025 18:27 UTC](https://forum.confluent.io/t/what-confluent-cloud-service-account-permissions-do-i-need-to-access-schema-registry/37704/2 "2025-04-27T18:27:22Z")

</div>

hey @alberttwong

could you please elaborate a bit?  
how did you create the service account?

best,  
michael

---

<div class="post-metadata">

**Author:** ![alberttwong](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/alberttwong/32/3910_2.png) [@alberttwong](https://forum.confluent.io/u/alberttwong)\
**Post date:** [28 April 2025 17:21 UTC](https://forum.confluent.io/t/what-confluent-cloud-service-account-permissions-do-i-need-to-access-schema-registry/37704/3 "2025-04-28T17:21:31Z")

</div>

In my app, I try to query the schema associated to the topic. When using a “my account”, the schema show up but when I use a service account, the schema doesn’t show up. There online docs for confluent cloud doesn’t explain any of the permission options. What I’d like to know is what permissions are needed for the schema to show up.

In additional, I’ve tried various combinations of from allow to all options for a given topic and added more permissions on the cluster but it doesn’t work.

You click on the cluster → api key → add key

 ![Screenshot 2025-04-28 at 10.20.39 AM](https://us1.discourse-cdn.com/flex019/uploads/confluentcommunity/original/2X/d/d18e349d4d0e4808a5d7de297e13917b902b5597.png)

---

<div class="post-metadata">

**Author:** ![dtroiano](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/dtroiano/32/1961_2.png) [@dtroiano](https://forum.confluent.io/u/dtroiano)\
**Post date:** [29 April 2025 18:44 UTC](https://forum.confluent.io/t/what-confluent-cloud-service-account-permissions-do-i-need-to-access-schema-registry/37704/4 "2025-04-29T18:44:11Z")

</div>

> [@alberttwong](#):
>
> You click on the cluster → api key → add key

Schema Registry needs a different API key (distinct from this path, which gives you an API key for Kafka). You can create one by clicking on your environment, then `Schema Registry` in the lefthand navigation, then click `API keys`, then `+ Add API key`. From here, pick the service account, click `Next`, then pick the environment and SR (`Always On Stream Governance Package`), click `Next`, then `Create API key`. This key is what you’d user in your app with client config:

```plaintext
basic.auth.credentials.source=USER_INFO
basic.auth.user.info=<SR API KEY>:<SR API SECRET>

```

Note that the service account should have RBAC set up to access Schema Registry. To do this, go to the top right hamburger icon, then `Accounts & access`, pick your service account, click `Access`, `View access`, `Edit access`, then pick the permissions you need (see [here](https://docs.confluent.io/cloud/current/sr/schemas-manage.html#access-control-rbac-for-sr-ccloud)). E.g., `All schema subjects` resource and `ResourceOwner` role.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/confluentcommunity/original/1X/c49438c90c9df282e9996fdf6971be890c71b65a.svg) [@system](https://forum.confluent.io/u/system)\
**Post date:** [10 June 2025 19:06 UTC](https://forum.confluent.io/t/what-confluent-cloud-service-account-permissions-do-i-need-to-access-schema-registry/37704/5 "2025-06-10T19:06:47Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.