> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blaxel.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Service accounts

> Automate the life-cycle of Blaxel resources via API through service accounts.

Service accounts are workspace users (i.e. identities) that represent an external system that needs to access Blaxel to operate resources in **one specific workspace**.

## Authentication of service accounts

### API keys

Service accounts can use [API keys](/Security/Access-tokens) to authenticate on Blaxel. These API keys can be created and managed by admins from the service account’s page, in your workspace settings.

API keys can have an infinite validity duration.

<img src="https://mintcdn.com/blaxel/opPwRTewCbLy-pVp/Security/Service-accounts/sa-api-key.webp?fit=max&auto=format&n=opPwRTewCbLy-pVp&q=85&s=75b17d80e6dc546e27221c971373cfc1" alt="sa-api-key.webp" width="2378" height="1310" data-path="Security/Service-accounts/sa-api-key.webp" />

### Client credentials (OAuth 2.0)

Service accounts can also use the *client credentials* [OAuth 2.0 grant type](/Security/Access-tokens), via their **client ID** and **client secret**. A pair client ID / client secret is generated automatically by Blaxel when you create a new service account.

<img src="https://mintcdn.com/blaxel/opPwRTewCbLy-pVp/Security/Service-accounts/sa-create2.webp?fit=max&auto=format&n=opPwRTewCbLy-pVp&q=85&s=8e62d813d26e0a137284245a6d491f4a" alt="sa-create2.webp" width="2254" height="1158" data-path="Security/Service-accounts/sa-create2.webp" />

<Warning>Make sure to copy the client secret when you create the service account as you will never be able to access it again after you leave the page.</Warning>

## Permissions of service accounts

Service accounts can have [similar permissions](/Security/Workspace-access-control) as other users from your team. These permissions are managed by admins in your workspace settings.