Skip to main content
A service account uses the OAuth 2.0 Client Credentials flow to authenticate without a human user. After an administrator creates the service account, complete the following steps to authenticate and issue requests.

​
Prerequisites

Before you begin, confirm the following:
  • An Administrator has created a service account and shared the Client Id and Client Secret with you. These credentials appear only once, when the service account is created. See Service Accounts for service account creation steps.
  • The service account has at least one permission assigned to a data connection or workspace. An Administrator sets permissions from the Edit Service Account page. See Permissions and Access Control for details.
  • The service account status is Active. An inactive service account cannot authenticate.
If you do not have the Client Secret, ask your Administrator to rotate the credentials for the service account from the Service Accounts tab on the Users page. The new secret displays immediately after the credentials rotation. The secret only appears once.

​
Authenticate

Follow the OAuth 2.0 Client Credentials steps in the Authentication guide to request a bearer token and make your first API call.

​
Verify the Setup

Run a query against a connection you have permission to access. A successful response confirms that the service account is authenticated and ready to use. If the request fails, check the following:
  • Expired token: Tokens expire after the expires_in duration. Request a new token and retry.
  • Missing permission: The service account must have permission to the connection it is querying. Contact your Administrator to verify or update permissions on the Service Accounts tab on the Users page.
  • Inactive account: The service account status must be Active. An Administrator can check and update the status from the Service Accounts tab on the Users page.