# Service accounts

Service accounts require an authentication token to be authenticated and must belong to at least one group for authorization.

Service accounts are commonly used for automation, for example, when using Lenses CLI or APIs, or any other application or service to interact with Lenses.

{% hint style="danger" %}
Service account tokens are not recoverable. You can edit, revoke or delete a Service Account, but you can never retrieve the original token.
{% endhint %}

## Creating a service account

To create a new Service Account, navigate to the **Admin** and select **Users** and **New Service Account**.

### Authentication token <a href="#authentication-token" id="authentication-token"></a>

You can manually enter the authentication token or autogenerate it. If you select to auto-generate tokens, then you will receive a one-time token for this service account. Follow the instructions and copy and store this token. You can now use this token to authenticate via API and CLI.

## Editing a service account

You can only change the groups and owner of services accounts. Go to the service account and select **Edit Info**, from the Actions menu.

## Revoking a service account

To change the token, go to the service account and select **Revoke Token** from the Actions menu.

## Using a service account

To use the service account you need to prefix the token with its name separated by a colon. You then include that in the corresponding header.

### Example <a href="#example" id="example"></a>

For a service account named `myservice` and a token `da6bad50-55c8-4ed4-8cad-5ebd54a18e26` then the combination looks like this:

`myservice:28ab4195-18cf-426a-abda-c41a451e001a`

To use the CLI with a service account for CI/CD you need to pass these options:

{% code fullWidth="false" %}

```bash
lenses-cli topics \
  --token=<service-account-name>:<service-account-token> \
  --host=<lenses-url-host>

# Real Example
lenses-cli topics \
  --token=ci:58d86476-bcc6-47e2-a57e-0c6bbd9c88b9 \
  --host=http://<your-lenses-url>:9991
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.lenses.io/latest/devx/5.5/deployment/configuration/iam/service-accounts.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.