> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mka1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Service accounts

> Use non-human identities for production applications and automation.

## Create a service account

For production systems, CI runners, backend services, and scheduled jobs, use a **service account** instead of a person's credentials. A service account is a non-human machine identity you attach to one or more teams, and mint API keys for. You can create one by navigating to **Access → Service accounts** and clicking **New service account** in the top right corner. Because keys inherit the team scope, detaching a service account from a team (or deleting it) immediately stops every key minted for it on that team, giving you a clean kill switch for production credentials.

## Create its API key

Follow [API keys](/docs/authentication) and select the service account as the principal. Choose the team and permissions needed by the application.

## Access lifecycle

Review team membership and key permissions when an application changes ownership. Before replacing a credential, identify the workloads using it and update those workloads before retiring the old key.