> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-platform/platform-access-control/add-and-manage-service-account.md).

# Manage service accounts

Service accounts are similar to [users](/harness-platform/use-harness-platform/platform-access-control/add-users.md) in Harness, but they are not associated with a human user. You assign [roles](/harness-platform/use-harness-platform/platform-access-control/add-manage-roles.md) and [resource groups](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-resource-groups.md) to a service account, and then you create [API keys](/harness-platform/use-harness-platform/automation/api/add-and-manage-api-keys.md) for it. Those API keys authenticate and authorize remote services that perform operations in Harness through Harness APIs, and they inherit the [role bindings](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md#role-binding) assigned to the service account.

***

### What you will learn in this topic <a href="#what-you-will-learn-in-this-topic" id="what-you-will-learn-in-this-topic"></a>

By the end of this topic, you will be able to:

* [Create a service account](#create-a-service-account) at any scope and assign its role bindings.
* [Manage API keys](#manage-api-keys) and tokens that inherit the service account permissions.
* [Edit a service account](#edit-a-service-account) to change its name, description, tags, or role bindings.
* [Delete a service account](#delete-a-service-account) that is no longer required.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Before you create and manage service accounts, ensure you have the following:

* **Harness account access**: A role such as **Account Admin** with view, create or edit, manage, and delete [permissions](/harness-platform/use-harness-platform/platform-access-control/permissions-reference.md) for service accounts.
* **Target scope access**: Access to the [scope](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md#permissions-hierarchy-scopes) where the service account belongs. You can create service accounts at all scopes.
* **RBAC familiarity**: An understanding of how roles and resource groups combine into role bindings. For more information, see [RBAC in Harness](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md).

***

### Create a service account <a href="#create-a-service-account" id="create-a-service-account"></a>

You can create a service account when a remote service, script, or integration needs to call Harness APIs without requiring a human user. The service account holds the role bindings, and every API key you generate under it inherits those permissions.

1. In Harness, navigate to the [scope](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md#permissions-hierarchy-scopes) where you want to add the service account.
   * To add a service account at the account scope, select **Account Settings**, and then select **Access Control**.
   * To add a service account at the organization scope, navigate to **Account Settings**, select **Organizations**, select the relevant organization, and then select **Access Control**.
   * To add a service account at the project scope, navigate to **Projects**, select the relevant project, and then select **Access Control**.
2. Select **Service Accounts** in the header.
3. Click **New Service Account**.
4. Enter a **Name** and **Email** for the service account.
5. Click **Save**.
6. Select **Manage Roles** next to the new service account.
7. Click **Add**, and then select a [role](/harness-platform/use-harness-platform/platform-access-control/add-manage-roles.md) and a [resource group](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-resource-groups.md). Repeat until you have configured all necessary [role bindings](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md#role-binding) for the service account.

***

### Manage API keys <a href="#manage-api-keys" id="manage-api-keys"></a>

Create API keys after you create a service account, because the API keys derive their permissions from the service account. Grant the service account the necessary role bindings first, otherwise API calls made with the token fail authorization.

To generate credentials, [create API keys and tokens](/harness-platform/use-harness-platform/automation/api/add-and-manage-api-keys.md#create-service-account-api-keys-and-tokens) for the service account. These tokens authenticate and authorize remote services that perform operations in Harness through Harness APIs, and they inherit the role bindings assigned to the service account.

For more information, see the [API permissions reference](/harness-platform/use-harness-platform/automation/api/api-permissions-reference.md#service-accounts).

***

### Edit a service account <a href="#edit-a-service-account" id="edit-a-service-account"></a>

You can change the name, description, tags, and role bindings, but the **Id** and **Email** are fixed after creation.

1. In Harness, navigate to the [scope](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md#permissions-hierarchy-scopes) where the service account exists.
   * To edit a service account at the account scope, select **Account Settings**, and then select **Access Control**.
   * To edit a service account at the organization scope, navigate to **Account Settings**, select **Organizations**, select the relevant organization, and then select **Access Control**.
   * To edit a service account at the project scope, navigate to **Projects**, select the relevant project, and then select **Access Control**.
2. Select **Service Accounts** in the header.
3. Locate the service account you want to edit.
4. Click the **More** icon (⋮).
5. Select **Edit** to change the **Name**, **Description**, or **Tags**. You cannot edit the **Id** or **Email**.
6. Select **Edit Role Bindings** to change the roles and resource groups assigned to the service account.

***

### Delete a service account <a href="#delete-a-service-account" id="delete-a-service-account"></a>

You can delete a service account when the integration that used it is obsolete. This way, its tokens can no longer authenticate against Harness APIs. Deleting the service account invalidates the API keys and tokens created under it.

1. In Harness, navigate to the [scope](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md#permissions-hierarchy-scopes) where the service account exists.
   * To delete a service account at the account scope, select **Account Settings**, and then select **Access Control**.
   * To delete a service account at the organization scope, navigate to **Account Settings**, select **Organizations**, select the relevant organization, and then select **Access Control**.
   * To delete a service account at the project scope, navigate to **Projects**, select the relevant project, and then select **Access Control**.
2. Select **Service Accounts** in the header.
3. Locate the service account you want to delete.
4. Click the **More** icon (⋮), and then select **Delete**.

***

### FAQ <a href="#faq" id="faq"></a>

<details>

<summary>Can a service account created at the project scope be assigned permissions to access an account-level resource?</summary>

No. A service account created at the project scope cannot be granted access to account-level resources. Instead, create an account-level service account and then provide project-level role bindings for it that correspond to the project. You can also provide role bindings for account-level templates.

</details>

<details>

<summary>How long is a service account token valid?</summary>

The validity depends on how you create the token. If you specify an expiry date, the token expires on that date. If you want the token to never expire, select the **No Expiration** option.

</details>

<details>

<summary>Can you identify which service account a token belongs to by looking at the token?</summary>

No. There is no way to determine the associated service account from a service account token such as `sat.w8EaJoerQcqqkZwcb...` by inspecting the token itself.

</details>

<details>

<summary>How do service account tokens differ from personal access tokens?</summary>

Personal access tokens are created at the user profile level and are prefixed with `pat.`, while service account tokens are created at the service account level and are prefixed with `sat.`. Harness does not assign permissions directly to tokens. A token inherits permissions from the user or the service account under which it was created.

</details>

***

### Related articles <a href="#related-articles" id="related-articles"></a>

* [Manage API keys](/harness-platform/use-harness-platform/automation/api/add-and-manage-api-keys.md): Create, rotate, and delete API keys and tokens for a service account.
* [Hierarchical support for service accounts](/harness-platform/use-harness-platform/platform-access-control/heirarchichal-support-for-service-accounts.md): Inherit account-level service accounts in organizations and projects.
* [RBAC in Harness](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md): Understand scopes, principals, roles, resource groups, and role bindings.
* [API permissions reference](/harness-platform/use-harness-platform/automation/api/api-permissions-reference.md): Review the permissions available to API keys and service accounts.