Advisory: Decommissioning Kurrent Cloud User Access Tokens

Applies to: automation that authenticates to Kurrent Cloud with a user access token (the API, the esc CLI, Terraform, CI/CD pipelines, or scripts)
Action required by: 15 September 2026

What You Need to Know

Kurrent Cloud user access tokens will stop working for automation after 15 September 2026. If any of your scripts, pipelines, or integrations authenticate to Kurrent Cloud with a user access token, migrate to a Service Account before then.

If the web console is all you use, this doesn't affect you.

Am I Impacted?

You are impacted if you authenticate to Kurrent Cloud with a user access token from any of:

Direct calls to the Kurrent Cloud API
The esc CLI running non-interactively, for example in a scheduled job
The Kurrent Cloud Terraform provider
CI/CD pipelines
Any other script or automation that uses a stored token

You are NOT impacted if you only sign in to the web console. Browser sign-in uses a different mechanism and is unaffected.

Background

A user access token authenticates as the person who created it. That causes two problems: the automation breaks when that person's account is disabled (for example when they leave the company,) and a token carries that user's full access rather than only what the integration needs.

Service Accounts replace user access tokens for automation. A Service Account is a non-human identity owned by the organization rather than a person. You grant it only the permissions an integration needs, and you can rotate or revoke its credentials without affecting any user account.

Symptoms

After 15 September 2026, a request that authenticates with a user access token will fail.

If you're unsure whether an integration is affected, check whether it authenticates with a token you created under your own account rather than with a Service Account's client ID and secret.

Resolution

In Kurrent Cloud, go to Access control → Service accounts.
Create a Service Account for the integration.
Grant it only the scopes it needs, following the principle of least privilege.
Create a client ID and secret, and store the secret securely. It is shown only once, at creation, and can be rotated or revoked later.
Update the integration to authenticate with the Service Account.
Verify it works, then delete the old user access token.

Complete the migration ahead of 15 September to avoid any disruption. If an integration breaks after that date, creating a Service Account and switching it over restores access right away.

Supported Tooling Versions

Make sure you are on a version that supports Service Account authentication, and upgrade first if you are not:

esc CLI: 1.30.0 or later
Kurrent Cloud Terraform provider (kurrent-io/kurrentcloud): 3.1.0 or later

How each tool takes Service Account credentials:

esc: the ESC_CLIENT_ID and ESC_CLIENT_SECRET environment variables. See Authenticate the esc CLI .
Terraform: client_id and client_secret in the provider configuration, or the same environment variables. See Authenticating as a service account .
Direct API: the OAuth 2.0 client credentials flow. See Authenticate the API directly .

Pulumi does not yet support Service Accounts and still authenticates with a user access token. If you manage Kurrent Cloud with the Pulumi provider , contact us before 15 September so we can help you plan the change.

For full instructions, see the Service Accounts documentation .