> For the complete documentation index, see [llms.txt](https://engyon.gitbook.io/engyon/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://engyon.gitbook.io/engyon/en/admin/organisation/create-a-service-account.md).
# Creating a service account
Creating a service account at Options → Organisation → Service accounts, for the Engyon API.
A **service account** is a machine identity for an integration. It does not log in via the browser. It uses a `client_id` and `client_secret`. You create it under Options → Organisation → Service accounts.
You need the right to update the organisation (usually Admin). Authentication and roles for the API itself are listed in [Configuration](/engyon/en/api/configuration.md).
## Create
1. Go to Options → Organisation.
2. Open the Service accounts tab.
3. In the top right, click the icon plus (:plus:) Service account.
4. Enter a **name** that indicates the purpose, for example `CRM-integration`.
5. Optionally enter a **description**.
6. Select one or more **roles** (`API account manager`, `API audit manager`, or both). What each role is allowed to do is listed in [Configuration](/engyon/en/api/configuration.md).
7. Click Create.
Engyon then shows the **client id** and **client secret** once.
{% hint style="danger" %}
Copy both values immediately and store them in a secrets manager. The client secret is **not shown again**. If you lose it, you must generate a new secret. Existing tokens for that service account will then become invalid.
{% endhint %}
## Manage existing account
In the Service accounts table you can:
| Action | Icon | What happens |
| ----------------- | ------------------------------------------------------------------ | -------------------------------------------------------------------------------------- |
| Edit | icon pencil (:pen:, tooltip `Edit`) | Name, description and roles |
| Regenerate secret | icon key (:key:, tooltip `Generate secret`) | New secret; existing tokens are immediately invalid |
| Delete | icon trash can (:trash:, tooltip `Delete`) | Credentials, the service account user and the role assignments. This cannot be undone. |
{% hint style="warning" %}
Regenerate the secret if it may have been leaked. Coordinate this with the integration team: the integration will stop until it uses the new secret.
{% endhint %}