> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Access tokens and Service Accounts

> Create and manage integration credentials in Settings.

Use a Personal Access Token when an integration should act as you. Use a Service Account when a non-human workload needs its own identity and access.

![Acme Labs personal access token list showing the active Acme Customer Portal Deployment token with General secret access and no visible token value.](https://mintcdn.com/airctrl/XQVytqi_NP8l26YA/images/app-guide/tokens-and-service-accounts/acme-customer-portal-token.png?fit=max\&auto=format\&n=XQVytqi_NP8l26YA\&q=85\&s=4d4a8f90b473a8751febf298213fdc94)

Acme Customer Portal Deployment is an active personal token with the General secret access scope. The token value is not shown.

## Create a Personal Access Token

1. Open **Settings** and choose **Access tokens**.
2. Select **Create token**.
3. Give the token a recognizable name and choose only the secret access it needs.
4. Create the token.

> [!WARNING]
>
> The complete token is shown once. Store it immediately in your approved secret manager. Do not place it in a screenshot, chat message, ticket, or source file.

Review existing tokens regularly. Revoke a token when it is no longer needed or may have been exposed.

## Create a Service Account

Open **Settings** and choose **Service accounts**. Create the Service Account, then use **Configure access** to assign only the roles and projects it needs.

![Acme Labs Service accounts list showing the active Acme Deployment Automation account with no permissions and a Configure access action.](https://mintcdn.com/airctrl/XQVytqi_NP8l26YA/images/app-guide/tokens-and-service-accounts/acme-deployment-automation.png?fit=max\&auto=format\&n=XQVytqi_NP8l26YA\&q=85\&s=e1cc7315f3794a441f04f8239d544188)

Acme Deployment Automation is active. Its access still needs to be configured before it can do project work.

Provision its credential through the Service Accounts screen. Review its secret access before you activate it. Disable it when work is paused. Delete it only after you confirm that dependent workloads have moved to another approved identity.

Service Account credential lifecycle actions are handled in the web app. Use the integration documentation for supported runtime use after an administrator has created the credential.

Read [Operate safely](https://docs.airctrl.dev/app-guide/operating-safely.md) before you revoke a credential or delete a Service Account.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.