Skip to main content
Service accounts are workspace users (i.e. identities) that represent an external system that needs to access Blaxel to operate resources in one specific workspace.

​
Authentication of service accounts

​
API keys

Service accounts can use API keys to authenticate on Blaxel. These API keys can be created and managed by admins from the service account’s page, in your workspace settings. API keys can have an infinite validity duration. sa-api-key.webp

​
Client credentials (OAuth 2.0)

Service accounts can also use the client credentials OAuth 2.0 grant type, via their client ID and client secret. A pair of client ID / client secret is generated automatically by Blaxel when you create a new service account. sa-create2.webp
Make sure to copy the client secret when you create the service account as you will never be able to access it again after you leave the page.

​
Permissions of service accounts

Service accounts have a role in the workspace, like other users from your team: admin, member or viewer. API keys and client credentials of a service account act with the permissions of its role. The role is set when the service account is created (admin by default):
  • from Workspace settings > Service accounts, when creating a service account
  • from Create workspace API key, which creates a service account and its API key in one step
Admins can change the role of a service account from its page in the workspace settings. With the Blaxel API, set role to admin, member or viewer when creating (POST /service_accounts) or updating (PUT /service_accounts/{clientId}) a service account. When role is omitted on update, the role stays the same.
Last modified on October 10, 2026