Service accounts
Open Settings, then Service accounts. This page is for admins. A member does not see it.
- Choose New service account. The dialog title is New service account.
- Enter a name and choose Create service account.
- On the row, open Account actions.
- Add to team puts the account on a team. The contracts it can read follow that team’s access.
- Create token issues a token for that account. Copy it. You will not see it again.
- Deactivate stops the account and its tokens.
The columns are Name, Status, and Created. An empty workspace says “No service accounts yet.” Deactivate asks “Deactivate this service account?” and “Its tokens will stop working straight away.”
A service-account token can read one contract at a time, by id, when its teams can see that contract. The contract list and every other contract route are refused. Creating a service account, creating its token from this flow, and changing its teams need a signed-in admin. A token cannot do those, and they are not MCP tools.
Member tokens, including read and write, are on API tokens.