> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sndbox.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Service accounts and tokens

> Create scoped non-interactive identities and one-time-visible bearer credentials.

Service accounts are non-interactive principals. They have no OIDC subject usable for password or browser login. Personal tokens use the `sbx_pat_…` prefix; service-account tokens use `sbx_sa_…` and contain 256 bits of random secret material.

## Credential rules

* The API returns the token value only in the creation response.
* PostgreSQL stores an HMAC-SHA-256 digest, never the token.
* Personal tokens expire within 90 days.
* Service-account policy allows 1–365 days; current API defaults use 30 days.
* Scopes, organisation, workspace IDs, and optional environment IDs are explicit.
* Effective access is the intersection of all restrictions and normal permissions.
* Revocation takes effect immediately and active service-account state is checked on every authentication.

```json title="Create a personal token" theme={"system"}
{
  "name": "GitHub Actions",
  "scopes": ["workflows.test", "deployments.manage"],
  "organisationId": "00000000-0000-4000-8000-000000000001",
  "workspaceIds": ["00000000-0000-4000-8000-000000000002"],
  "environmentIds": ["00000000-0000-4000-8000-000000000003"],
  "expiresInDays": 30
}
```

<Warning>
  Capture `credential.token` directly into a CI secret store, then discard the response. Do not print the creation body in logs.
</Warning>

## Signed client assertions

Credential administrators can register an Ed25519 public key. A client signs a short-lived EdDSA JWT and exchanges it for a 15-minute bearer credential. The private key stays in the client's secret manager; `iss` and `sub` identify the service account, `aud` names the token endpoint, `jti` prevents replay, and requested scopes/workspaces/environments are bounded by the registered account.

See [API authentication](/developers/authentication) for request use and the generated API reference for every operation.