# Temporal Cloud

> Connect a Temporal Cloud service account API key to LevelFour.

Source: https://docs.levelfour.ai/connectors/temporal


## Prerequisites

* A Temporal Cloud account.
* An Account Owner or Global Admin, to create the service account and its API key.

## Connect

### Create a service account in Temporal Cloud

As an Account Owner, go to **Settings > Identities** and create a service account with the account-level role **Finance Admin**, and Read-Only access on each namespace.

Generate an API key for that service account under **Settings > API keys**, and copy it.

### Add it to LevelFour

Open **Connect Providers**, select **Temporal Cloud**, and paste the API key. Click **Add Service account API key**.

## Confirming it worked

The connection moves to **Connected**. Your first data appears within a day.

## Rotating or removing access

### Rotating the credential

Generate a new API key for the same service account in Temporal Cloud, paste it into **Connect Providers**, then revoke the old key.

### Removing access

Disconnect Temporal Cloud under **Connect Providers**, then revoke the API key or delete the service account in Temporal Cloud.

## Troubleshooting

| Symptom                                              | What to do                                                                                                                                 |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| The service account cannot be created                | Only an Account Owner or Global Admin can create a service account and grant it Finance Admin. A Namespace Admin cannot                    |
| The connection stops working after a couple of years | Temporal Cloud API keys expire after at most two years. Temporal emails the account before expiry; rotate the key when you get that notice |
| A namespace added later is missing                   | Namespace permissions are not automatic. Grant the service account Read-Only access on any namespace added after the initial setup         |

## Next

* [Connect Providers](/connectors) lists every provider you can connect