> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Service account key format

> The structure of an e6data service account API key and how it's stored.

A service account API key is a four-part, underscore-separated string carrying a workspace-scoped machine identity.

```
e6sa_<workspace>_<keyId>_<secret>
```

| Segment | Meaning |
| - | - |
| `e6sa_` | The service-account prefix - checked before any lookup |
| `<workspace>` | The workspace the key is scoped to (keys don't span workspaces) |
| `<keyId>` | The key's identifier |
| `<secret>` | The secret material |

* The full value is **shown once**, at creation; the secret is stored hashed and cannot be retrieved again.
* A service account can hold multiple keys (rotate freely). Deleting the service account revokes all its keys.
* Like a PAT, the key carries identity only - permissions come from the service account's role bindings.

The other prefix is `e6pat_` (personal access token). See the canonical [token-types table](/platform/tokens/pat-and-service-account-keys).

## See also

* [Personal access token format](/platform/reference/tokens/personal-access-token)
* [Token lifecycle states](/platform/reference/tokens/lifecycle-states)
* [Users, groups, and service accounts](/platform/identity/users-groups-service-accounts)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.