# Service accounts Service accounts are a way for organizations to provide manageable, controllable, and granular access to JetBrains Central Console to enable automations and services such as access to the [Analytics API](analytics-api.html). From an organizational perspective, service accounts let application and service integrations and automations use account credentials that are not tied to a specific user but are specifically created for the application or service. This prevents scenarios where automations or CI scripts lose access to JetBrains Central Console due to a user account being deleted or disabled, and their access credentials revoked. Service accounts are created and managed by JetBrains Central Console users with appropriate permissions, who can perform all actions described below. > **Note:** > In addition to user-created service accounts, JetBrains Central Console also includes system-created service accounts. These are generated automatically by external applications or services with the necessary permissions. This automation eliminates the need to manually create accounts or copy credentials between JetBrains Central Console and external services. > > > > System-created accounts can't be modified but can be deleted. ## Service account usage costs Service account usage consumes [AI credits](ai-governance.html#ai-credits) from the same organization-level credit pool as regular users. The consumption usually comes from background tasks, autonomous runs, or other similar implementations that run through service-account-based integrations. For actions initiated by a user, such as [running a cloud task in Air](https://www.jetbrains.com.cn/en-us/help/air/run-tasks-in-cloud.html), the AI credit consumption is attributed to the user who initiated the action. Some JetBrains Central Console functionalities require a service account to work, but their usage is not charged in AI credits. For example, requests to the [Analytics API](analytics-api.html) do not consume AI credits as no LLM tokens are spent for API access and request processing. ## Manage service accounts > **Note:** > Managing service accounts is available only for users with the [Manage organization](roles.html#permissions_manage_org) permission. Use the Service accounts page to add, update, or delete service accounts, assign and change permissions within service accounts, and copy account credentials. Procedure: Create a service account 1. In the sidebar, under Users and access, select Service accounts. If you don't see this page, your role doesn't have the necessary [permissions](roles.html#permissions). 2. In the top-right corner, click Add service account. 3. In the dialog, enter the service account Name and Description. 4. Click Create service account. Client ID and Client secret for the service account are displayed. 5. Copy the client secret as you won't be able to see it again. You will use client ID and client secret to [get an access token](exchange-client-id-and-secret-for-an-access-token.html) that will let you integrate your own applications or services with JetBrains Central Console. Procedure: View service account credentials 1. In the sidebar, under Users and access, select Service accounts. If you don't see this page, your role doesn't have the necessary [permissions](roles.html#permissions). 2. Click the ![Ellipsis icon](images/union.svg) menu next to the account name and select View credentials. A dialog opens, showing the Client ID and Client secret fields. To copy the client ID, click copy ![Copy icon](images/copy-service-accounts.svg) next to its value. > **Tip:** > This dialog lets you copy only the client ID. You can only see and copy the client secret when you [add a service account](#add-service-account). If you no longer know the client secret for the service account, you can only rotate it. For more information, see [Rotate the client secret](#change-secret). Procedure: Rotate the client secret 1. In the sidebar, under Users and access, select Service accounts. If you don't see this page, your role doesn't have the necessary [permissions](roles.html#permissions). 2. Click the ![Ellipsis icon](images/union.svg) menu next to the account name and select View credentials. A dialog opens, showing the Client ID and Client secret fields. 3. In the Client secret field, click Rotate secret. A new client secret is generated and displayed. Copy the key as you won't be able to see it again. > **Warning:** > Changing the client secret invalidates its previous value. Any applications or services that use the previous client secret will no longer be able to [get new access tokens](exchange-client-id-and-secret-for-an-access-token.html) until the secret is updated. If there is a token generated with the previous secret that still hasn't expired, it remains valid until its expiration. Procedure: Manage service account permissions You can define permissions for service accounts by assigning or removing [roles](roles.html). Each role includes a set of permissions that defines the access rights and allowed actions. > **Note:** > Service accounts currently support only the [View AI analytics](roles.html#permissions_view_ai_analytics) permission, which provides access to the [Analytics API](analytics-api.html). While you can assign roles that include other permissions, only the View AI analytics permission will have an effect. 1. In the sidebar, under Users and access, select Service accounts. If you don't see this page, your role doesn't have the necessary [permissions](roles.html#permissions). 2. Click the ![Ellipsis icon](images/union.svg) menu next to the service account and select Change permissions. The Change permissions dialog shows the roles assigned to the service account and the combined set of permissions this service account has based on these roles. When assigning a [group-scoped](roles.html#role-scopes) role, select the groups to which the relevant permissions should apply. For example, a service account responsible for fetching your department's AI analytics should have a role allowing it to view AI analytics of several product development groups within your department. * Assign a role by clicking Assign role and selecting a role from the list. To create a new role, select New role from the Assign role menu. * Remove a role by clicking ![Remove role icon](images/remove-role.svg) next to the role you want to remove. To change permissions for multiple service accounts, select the checkboxes next to the service accounts, click Assign role at the bottom, and select the role you want to assign. > **Note:** > You can add roles to multiple service accounts only if all selected service accounts are user-created. Procedure: Rename a service account 1. In the sidebar, under Users and access, select Service accounts. If you don't see this page, your role doesn't have the necessary [permissions](roles.html#permissions). 2. Click the ![Ellipsis icon](images/union.svg) menu next to the account name and select Edit account details. The Service account details dialog opens. 3. In the dialog, enter the new service account Name. You can also change the account Description. 4. Click Save to confirm. Procedure: Delete service accounts > **Warning:** > Deleting a service account used by an external application or service will result in the application or service losing access to JetBrains Central Console. 1. In the sidebar, under Users and access, select Service accounts. If you don't see this page, your role doesn't have the necessary [permissions](roles.html#permissions). 2. Click the ![Ellipsis icon](images/union.svg) menu next to the account name and select Delete. A confirmation dialog opens. 3. Click Delete. To delete multiple service accounts, select the checkboxes next to the accounts, click Delete service accounts at the bottom of the screen, and confirm account deletion.