> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Service Accounts

> Create and manage the integration identities that own your organization's API keys and OAuth clients.

A service account is a named identity for an integration. It owns API keys or
OAuth clients and carries the permissions those credentials may use, so access
review happens at the account level: what an integration can do is visible in
one place, regardless of how
many credentials it holds. The account itself is not a credential: its ID
cannot authenticate a request. See [Authentication](/developers/v1/authentication)
to choose a method; an API-key integration does not need OAuth.

Manage service accounts from the **Service accounts** tab of the
[Developer Hub](/developers/developer-hub/overview).

## Design your accounts around workloads

Create one service account per integration or workload — for example
`reporting-pipeline`, `scim-sync`, or `soc-enrichment` — rather than one
broad account for everything. Per-workload accounts keep permissions
minimal, make [request logs](/developers/developer-hub/request-logs)
attributable, and let you disable one integration without touching the
others.

## Create a service account

<Steps>
  <Step title="Name the account">
    Give the account a name that identifies the workload it serves, and a
    description of what it does. Both appear in lists and logs, so future
    admins can tell accounts apart.
  </Step>

  <Step title="Grant permissions">
    Select the permissions the account may grant to its credentials — for example
    `entity:read`, `simulation:read`, or `reporting:read`. This set is the
    ceiling for every credential created under the account: a credential can carry a subset
    of these permissions, never more.

    <Tip>
      Grant the minimum the workload needs today. You can add account permissions
      later; existing credentials keep their granted scopes.
    </Tip>
  </Step>

  <Step title="Review and create">
    Confirm the name and permission set. After creation, the account's detail
    page is where you [create its API keys](/developers/developer-hub/api-keys).
  </Step>
</Steps>

## Manage the lifecycle

* **Edit permissions at any time.** Removing a permission from the account
  removes it from what its API keys and OAuth access tokens can exercise.
* **Disable an account** to stop API access through all its credentials — useful when
  offboarding an integration or containing a suspected credential leak while
  you investigate. Re-enabling allows credentials that are still active and
  unexpired to authenticate again.
* **Delete an account** when the integration has been retired. Stop the
  integration and revoke its credentials first. Deletion is permanent.

Each account's detail page shows who created it, when, and when one of its
keys was last used — a quick way to spot abandoned integrations that should
be disabled.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.