Service account key format

A service account API key is a four-part, underscore-separated string carrying a workspace-scoped machine identity.

e6sa_<workspace>_<keyId>_<secret>

Segment	Meaning
`e6sa_`	The service-account prefix - checked before any lookup
`<workspace>`	The workspace the key is scoped to (keys don’t span workspaces)
`<keyId>`	The key’s identifier
`<secret>`	The secret material

The full value is shown once, at creation; the secret is stored hashed and cannot be retrieved again.
A service account can hold multiple keys (rotate freely). Deleting the service account revokes all its keys.
Like a PAT, the key carries identity only - permissions come from the service account’s role bindings.

The other prefix is e6pat_ (personal access token). See the canonical token-types table.

See also