> ## Documentation Index
> Fetch the complete documentation index at: https://blaxel-mintlify-b51065bf.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Service accounts

> Use Blaxel service accounts with non-user API credentials to automate the full life-cycle of resources in CI/CD pipelines and backend systems.

Service accounts are workspace users (i.e. identities) that represent an external system that needs to access Blaxel to operate resources in **one specific workspace**.

## Authentication of service accounts

### API keys

Service accounts can use [API keys](/Security/Access-tokens) to authenticate on Blaxel. These API keys can be created and managed by admins from the service account’s page, in your workspace settings.

API keys can have an infinite validity duration.

<img src="https://mintcdn.com/blaxel-mintlify-b51065bf/mAaAlNJO6ji40URQ/Security/Service-accounts/sa-api-key.webp?fit=max&auto=format&n=mAaAlNJO6ji40URQ&q=85&s=06d78a1f771f5ee74d575d18a2974c16" alt="sa-api-key.webp" width="2378" height="1310" data-path="Security/Service-accounts/sa-api-key.webp" />

### Client credentials (OAuth 2.0)

Service accounts can also use the *client credentials* [OAuth 2.0 grant type](/Security/Access-tokens), via their **client ID** and **client secret**. A pair client ID / client secret is generated automatically by Blaxel when you create a new service account.

<img src="https://mintcdn.com/blaxel-mintlify-b51065bf/mAaAlNJO6ji40URQ/Security/Service-accounts/sa-create2.webp?fit=max&auto=format&n=mAaAlNJO6ji40URQ&q=85&s=b105b2a9b750442d467bbebf0c470933" alt="sa-create2.webp" width="2254" height="1158" data-path="Security/Service-accounts/sa-create2.webp" />

<Warning>Make sure to copy the client secret when you create the service account as you will never be able to access it again after you leave the page.</Warning>

## Permissions of service accounts

Service accounts can have [similar permissions](/Security/Workspace-access-control) as other users from your team. These permissions are managed by admins in your workspace settings.