> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Service accounts

export const Danger = ({children}) => {
  return <div class="callout my-4 px-5 py-4 overflow-hidden rounded-2xl flex gap-3 border danger-admonition dark:danger-admonition" data-callout-type="danger">
      <div class="mt-0.5 w-4">
        <svg width="14" height="14" viewBox="0 0 14 14" fill="rgb(239, 68, 68)" xmlns="http://www.w3.org/2000/svg" class="w-4 h-4 text-sky-500" aria-label="Danger">
          <path fill-rule="evenodd" clip-rule="evenodd" d="M7 1.3C10.14 1.3 12.7 3.86 12.7 7C12.7 10.14 10.14 12.7 7 12.7C5.48908 12.6974 4.0408 12.096 2.97241 11.0276C1.90403 9.9592 1.30264 8.51092 1.3 7C1.3 3.86 3.86 1.3 7 1.3ZM7 0C3.14 0 0 3.14 0 7C0 10.86 3.14 14 7 14C10.86 14 14 10.86 14 7C14 3.14 10.86 0 7 0ZM8 3H6V8H8V3ZM8 9H6V11H8V9Z"></path>
        </svg>
      </div>
      <div class="text-sm prose min-w-0 w-full">
        {children}
      </div>
    </div>;
};

Service accounts enable programmatic access to channels by allowing users to generate [resource tokens](/docs/psm-on-prem/6.7.2/user/auth_token#token-types) that are not tied to individual user credentials. Service accounts are especially useful for scenarios where access needs to persist beyond the lifecycle of a user account.

<Note>
  Service accounts count as a user against your [license limit](/docs/psm-on-prem/6.7.2/admin/license#viewing-your-license)!
</Note>

## Viewing service accounts

You can view your service accounts at any time by selecting <Icon icon="user-shield" iconType="regular" /> **Service Accounts** from the left-hand navigation.

Select a service account from the list to view the tokens associated with that service account.

<Frame>
  <img src="https://mintcdn.com/anaconda-29683c67/SgtHPGS_3WUV3NOk/images/service_account_tokens.png?fit=max&auto=format&n=SgtHPGS_3WUV3NOk&q=85&s=8c6e51d6e286ca4d4c456d8f4895db2d" alt="" width="1922" height="688" data-path="images/service_account_tokens.png" />
</Frame>

## Creating a service account

To create a service account for a channel, you must belong to the channel’s `<CHANNEL_NAME>_owners` group.

1. Select <Icon icon="user-shield" iconType="regular" /> **Service Accounts** from the left-hand navigation.

2. Click <Icon icon="plus" iconType="light" /> **Create Service Account** beside the channel you want to create a service account for.

   <Tip>
     This is disabled for channels that have an existing service account.
   </Tip>

3. Click **Create**.

<Note>
  Service accounts are created with the name `service-account-channel-<CHANNEL_NAME>`.
</Note>

## Creating a service account token

Service accounts can have multiple resource tokens, each configured with unique permissions, descriptions, and expiration dates.

1. Select <Icon icon="user-shield" iconType="regular" /> **Service Accounts** from the left-hand navigation.

2. Select the service account you want to generate a token for.

3. Click <Icon icon="circle-plus" iconType="light" /> **Generate Token**.

4. Enter a unique name for your token.

5. (Optional) Provide a description of the token’s intended purpose.

6. Select an expiration date for your token.

7. Open the **Permission** dropdown and select a permission level for this token.

   <Note>
     You can only grant permissions to the service account token that you currently hold.
   </Note>

8. Open the **Channel** dropdown and select the channel that this token provides access to.

   <Note>
     Setting the value for the **Channel** dropdown automatically updates the **Resource** dropdown. Skip that field.
   </Note>

9. If you want to add an additional resource to this token, select  **Add Resource** and repeat the process.

10. Click **Create**.

11. Your service account token appears in the upper-right corner. Copy this value, then close the notification.

    <Note>
      The notification containing your service account token remains visible until you close it, giving you plenty of time to copy the value. Once closed, the token value cannot be retrieved again, and you will need to generate a new token.
    </Note>

    <Danger>
      Treat tokens like they are sensitive credentials. If a token is compromised, delete it immediately.
    </Danger>

## Managing service account tokens

### Token actions

<Icon icon="pencil" iconType="light" /> **Edit**: You can edit the name, description, and expiration date of your token without changing the token’s value. If you want to invalidate and replace the previous token, select **Issue a note token**.

<Icon icon="trash" iconType="light" color="red" /> **Delete**: You can delete your token at any time.

<Warning>
  Issuing a new token or deleting a token will break any workflows that have these values embedded.
</Warning>

## Adding a service account to a channel

If you want your service account to be able to provide access to another channel, you must request that the channel owner add your service account to their channel’s `<CHANNEL_NAME>_owners` group. For instructions, see [Adding members to a group](/docs/psm-on-prem/6.7.2/user/groups#adding-members-to-a-group).
