> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Service Account Setup

> Configure and start using a service account in Connect AI after an administrator creates it.

A service account uses the OAuth 2.0 Client Credentials flow to authenticate without a human user. After an administrator creates the service account, complete the following steps to authenticate and issue requests.

## Prerequisites

Before you begin, confirm the following:

* An Administrator has created a service account and shared the **Client Id** and **Client Secret** with you. These credentials appear only once, when the service account is created. See [**Service Accounts**](/en/Service-Accounts) for service account creation steps.
* The service account has at least one permission assigned to a data connection or workspace. An Administrator sets permissions from the **Edit Service Account** page. See [Permissions and Access Control](/en/Permissions) for details.
* The service account status is **Active**. An inactive service account cannot authenticate.

<Note>
  If you do not have the **Client Secret**, ask your Administrator to rotate the credentials for the service account from the [**Service Accounts**](/en/Service-Accounts) tab on the **Users** page. The new secret displays immediately after the credentials rotation. The secret only appears once.
</Note>

## Authenticate

Follow the [OAuth 2.0 Client Credentials](/en/API/Authentication#oauth-client-credentials) steps in the Authentication guide to request a bearer token and make your first API call.

## Verify the Setup

Run a query against a connection you have permission to access. A successful response confirms that the service account is authenticated and ready to use.

If the request fails, check the following:

* **Expired token**: Tokens expire after the `expires_in` duration. Request a new token and retry.
* **Missing permission**: The service account must have permission to the connection it is querying. Contact your Administrator to verify or update permissions on the [**Service Accounts**](/en/Service-Accounts) tab on the **Users** page.
* **Inactive account**: The service account status must be **Active**. An Administrator can check and update the status from the [**Service Accounts**](/en/Service-Accounts) tab on the **Users** page.