Service accounts and tokens

​

Credential rules

• The API returns the token value only in the creation response.
• PostgreSQL stores an HMAC-SHA-256 digest, never the token.
• Personal tokens expire within 90 days.
• Service-account policy allows 1–365 days; current API defaults use 30 days.
• Scopes, organisation, workspace IDs, and optional environment IDs are explicit.
• Effective access is the intersection of all restrictions and normal permissions.
• Revocation takes effect immediately and active service-account state is checked on every authentication.

{
  "name": "GitHub Actions",
  "scopes": ["workflows.test", "deployments.manage"],
  "organisationId": "00000000-0000-4000-8000-000000000001",
  "workspaceIds": ["00000000-0000-4000-8000-000000000002"],
  "environmentIds": ["00000000-0000-4000-8000-000000000003"],
  "expiresInDays": 30
}

​

Signed client assertions