# Service Accounts

Service accounts are intended for programmatic access to Lenses.

{% hint style="info" %}
Service accounts are assigned to groups. The groups inherit permissions from the roles assigned to the groups.
{% endhint %}

Each service account has a token used to authenticate and identify it.

You can also set:

1. Description
2. Resource name (must be unique across Lenses)
3. Token expiry
4. Regenerate the token

Token expiry can be 7, 30, 60, 90 days, 1 year, a custom expiry, or no expiry.

## Create a Service Account

To create a service account, go to **IAM → Service Accounts → New Service Account**. After creation, assign the service account to one or more groups.

<figure><img src="/files/sHO3tFsDUkyoetOmd49o" alt=""><figcaption><p>IAM Service Account</p></figcaption></figure>

You can also manage service accounts via the CLI and YAML, for CI/CD automation.

{% code title="terminal" %}

```shell
➜  hq service-accounts
Manage ServiceAccounts.

Usage:
  hq service-accounts [command]

Aliases:
  service-accounts, sa

Available Commands:
  create      Creates a new ServiceAccount.
  delete      Deletes a ServiceAccount.
  get         Returns a specific ServiceAccount.
  list        Returns all ServiceAccounts.
  metadata    Manages service-account metadata.
  renew-token Renews the service account's token. The current token is invalidated and a new one is generated. An optional expiration timestamp can be provided.
  set-groups  Assigns the given service account exactly to the provided groups, ensuring they are not part of any other groups.
  update      Updates a service account.
```

{% endcode %}

## API Calls

When calling the Lenses APIs, send the service account token in the `Authorization` header:

```http
Authorization: Bearer <service_account_token>
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.lenses.io/latest/devx/6.1/user-guide/iam/service-accounts.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.