This topic explains how to configure the MART service account.
Adding the MART service account
MART and Apigee Connect require a Google Cloud service account for authentication.
Locate the key file for the apigee-mart service account.
The file should have a .json extension. It should reside in the apigee-org directory or a subdirectory.
PROD installations: apigee-mart.json
NON-PROD installations: apigee-non-prod.json
If you do not see the MART service account file, create and download it with the
create-service-account utility:
Make sure your PROJECT_ID environment variable is set:
echo $PROJECT_ID
Define it if needed:
export PROJECT_ID=my-project-id
Create the MART service account. You can find the create-service-account tool in:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-26 UTC."],[[["\u003cp\u003eThe MART and Apigee Connect services require a Google Cloud service account for authentication, unless using workload identity on AKS, EKS, or GKE.\u003c/p\u003e\n"],["\u003cp\u003eThe MART service account key file, either \u003ccode\u003eapigee-mart.json\u003c/code\u003e for PROD or \u003ccode\u003eapigee-non-prod.json\u003c/code\u003e for NON-PROD, should be located in the \u003ccode\u003eapigee-org\u003c/code\u003e directory or a subdirectory.\u003c/p\u003e\n"],["\u003cp\u003eIf the MART service account file is missing, it can be created and downloaded using the \u003ccode\u003ecreate-service-account\u003c/code\u003e utility, which is found in the \u003ccode\u003eAPIGEE_HELM_CHARTS_HOME/apigee-operator/etc/tools/\u003c/code\u003e directory.\u003c/p\u003e\n"],["\u003cp\u003eThe path to the MART service account key file must be specified in the \u003ccode\u003econnectAgent.serviceAccountPath\u003c/code\u003e and \u003ccode\u003emart.serviceAccountPath\u003c/code\u003e properties within the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file.\u003c/p\u003e\n"],["\u003cp\u003eTo apply the changes, you need to use the command \u003ccode\u003ehelm upgrade ORG_NAME apigee-org/ --namespace apigee --atomic -f OVERRIDES_FILE.yaml\u003c/code\u003e, replacing \u003ccode\u003eupgrade\u003c/code\u003e with \u003ccode\u003einstall\u003c/code\u003e if it's the initial deployment.\u003c/p\u003e\n"]]],[],null,["# Configure the MART service account\n\n| You are currently viewing version 1.13 of the Apigee hybrid documentation. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to configure the MART service account.\n\nAdding the MART service account\n-------------------------------\n\n\nMART and Apigee Connect require a Google Cloud service account for authentication.\n| **Note:** Installations on AKS, EKS, or GKE using workload identity do not require a Google Cloud service account key file (`.json`). See [Enabling Workload Identity on GKE](/apigee/docs/hybrid/v1.13/enable-workload-identity-gke) and [Enabling Workload Identity Federation on AKS and EKS](/apigee/docs/hybrid/v1.13/enable-workload-identity-federated).\n\n1. Locate the key file for the `apigee-mart` service account. The file should have a `.json` extension. It should reside in the `apigee-org` directory or a subdirectory.\n - **PROD** installations: `apigee-mart.json`\n - **NON-PROD** installations: `apigee-non-prod.json`\n2. If you do not see the MART service account file, create and download it with the `create-service-account` utility:\n 1. Make sure your `PROJECT_ID` environment variable is set: \n\n ```\n echo $PROJECT_ID\n ```\n\n Define it if needed: \n\n ```\n export PROJECT_ID=my-project-id\n ```\n 2. Create the MART service account. You can find the `create-service-account` tool in: \n\n ```\n APIGEE_HELM_CHARTS_HOME/\n └── apigee-operator/\n └── etc/\n └── tools/\n └── create-service-account\n ```\n\n ### PROD\n\n ```\n create-service-account \\\n --env prod \\\n --profile apigee-mart \\\n --dir PATH_TO_apigee-org_CHART_DIR\n ```\n\n ### NON-PROD\n\n ```\n $HYBRID_FILES/tools/create-service-account \\\n --env non-prod \\\n --profile apigee-mart \\\n --dir PATH_TO_apigee-org_CHART_DIR/\n ```\n3. Edit your `overrides.yaml` file and add the key file path to the `connectAgent` and `mart.serviceAccountPath` properties:\n\n ### PROD\n\n ```actionscript-3\n connectAgent:\n serviceAccountPath: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003epath_to_apigee\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003emart\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e.\u003c/span\u003e\u003cspan class=\"devsite-syntax-na\"\u003ejson\u003c/span\u003e\u003c/var\u003e\n\n mart:\n serviceAccountPath: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003epath_to_apigee\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003emart\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e.\u003c/span\u003e\u003cspan class=\"devsite-syntax-na\"\u003ejson\u003c/span\u003e\u003c/var\u003e\n ```\n\n ### NON-PROD\n\n ```actionscript-3\n connectAgent:\n serviceAccountPath: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003epath_to_apigee\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003enon\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003eprod\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e.\u003c/span\u003e\u003cspan class=\"devsite-syntax-na\"\u003ejson\u003c/span\u003e\u003c/var\u003e\n\n mart:\n serviceAccountPath: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003epath_to_apigee\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003enon\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003eprod\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e.\u003c/span\u003e\u003cspan class=\"devsite-syntax-na\"\u003ejson\u003c/span\u003e\u003c/var\u003e\n ```\n\n\n For example: \n\n ```\n ...\n connectAgent:\n serviceAccountPath: /apigee/hybrid/helm-charts/apigee-org/apigee-mart.json\n\n mart:\n serviceAccountPath: /apigee/hybrid/helm-charts/apigee-org/apigee-mart.json\n ...\n ```\n4. Apply your changes: \n\n ```\n helm upgrade ORG_NAME apigee-org/ \\\n --namespace apigee \\\n --atomic \\\n -f OVERRIDES_FILE.yaml\n ```\n | **Note:** If you see an error saying `Error: UPGRADE FAILED: \"`*ORG_NAME*`\" has no deployed releases`, replace `upgrade` with `install` and try the command again."]]