> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/ccluster/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/ccluster/_mcp/server.

# Service Accounts

> Create and manage machine credentials for automation, CI pipelines, and integrations

Service accounts are **non-human credentials** for automation — CI pipelines, scheduled jobs, and integrations that need to call NVIDIA CCluster APIs without a browser login. Each service account has a **Client ID** and **Client Secret** you use to authenticate programmatically.

Service accounts are **scoped to the user who creates them and the organization they belong to**. You only see and manage service accounts you created in your current organization. API calls made with a service account run as that user within that organization — they cannot access resources in other organizations or service accounts created by other users.

> **Note**
>
> Service accounts authenticate to **NVIDIA CCluster platform APIs** (for example, listing deployments or creating workloads through the SDK). They are separate from [Vault bearer tokens](/ccluster/resources/vault), which protect your deployed inference endpoints. See [Securing Endpoints](/ccluster/resources/private) for endpoint access.

## Prerequisites

Before creating a service account, you need:

* An active NVIDIA CCluster account provisioned for your organization
* Access to the organization where the automation will run — service accounts are tied to **your user** and **that organization**
* Permissions for the scopes you want to grant — you can only assign scopes you already hold

## Create a service account

1. Log in to the NVIDIA CCluster UI.
2. Select **Service Accounts** from the sidebar.
3. Click **Create service account**.
4. Enter a **Name** (required) and optional **Description** — for example, `CI pipeline` or `nightly-evaluation`.
5. Select the **Scopes** your automation needs. Only scopes you hold are available; UI-only permissions are not grantable.
6. Click **Create**.

After creation, a modal displays your **Client Secret**. Copy and store it immediately — **this is the only time the full secret is shown**.

The service account list also shows the **Client ID** for each account. You can copy it at any time from the list.

## Use service account credentials

Store the **Client ID** and **Client Secret** in a secret manager or your CI/CD secret store. Never commit them to source control.

For unattended automation with the `centml` SDK or CLI, set the following environment variables:

```bash showLineNumbers={false}
export CENTML_SERVICE_ACCOUNT_ID="<your_client_id>"
export CENTML_SERVICE_ACCOUNT_SECRET="<your_client_secret>"
```

The SDK uses these credentials to obtain an access token automatically — no browser login required. Once configured, use the client as you would after an interactive `centml login`:

```bash showLineNumbers={false}
ccluster ls
```

```python
import centml
from centml.sdk.api import get_centml_client
from centml.sdk import DeploymentType

with get_centml_client() as cclient:
    deployments = cclient.get(DeploymentType.INFERENCE_V3)
    print(deployments)
```

> **Tip**
>
> Use one service account per automation or integration so you can rotate or revoke credentials independently.

## Manage service accounts

From the **Service Accounts** page, you can:

| Action                | Description                                                                |
| --------------------- | -------------------------------------------------------------------------- |
| **Edit**              | Update the name, description, or scopes                                    |
| **Regenerate secret** | Generate a new Client Secret (shown once) — use this to rotate credentials |
| **Delete**            | Permanently remove the service account                                     |

> **Note**
>
> Deleting a service account takes effect immediately. Any integration using its credentials will stop working.

When you regenerate a secret, copy the new value right away. The previous secret may continue to work until you rotate integrations to the new one.

## Security best practices

* **Least privilege** — grant only the scopes your automation needs.
* **One account per use case** — separate CI, staging, and production automations.
* **Rotate regularly** — regenerate secrets on a schedule or after team changes.
* **Store secrets securely** — use a secret manager or CI secret store, not environment files in your repository.
* **Revoke promptly** — delete service accounts when an integration is retired.

API requests made with a service account are attributed to the user who created it and that user's organization.

## Limits and important notes

* You can create at most **5 active service accounts** per user per organization.
* Service accounts belong to the **creating user** and **current organization** — switch organizations in the UI to manage accounts for a different org, or have each team member create their own accounts.
* The **Client Secret** is shown only once at creation or regeneration — if you lose it, generate a new secret.
* You cannot grant scopes you do not hold.
* Scopes are fixed at creation time based on your permissions when you create or update the account; if your role changes later, review and update service account scopes as needed.

## What's next

#### [Client Setup](/ccluster/clients/setup)

Install and configure the NVIDIA CCluster client.

#### [Python SDK Reference](/ccluster/clients/sdk)

Access NVIDIA CCluster programmatically using Python.

#### [Managing Vault Objects](/ccluster/resources/vault)

Generate bearer tokens and other secrets for deployments and endpoints.