e6data has two credential types. This page covers each in detail. For step-by-step creation, see Create, use, rotate, and revoke tokens.
Personal access tokens (e6pat_)
A PAT authenticates the API as you and inherits exactly your roles in the workspace. Use a PAT for your own scripts, notebooks, and BI tool connections.
- When to use: connecting a BI tool over JDBC, calling the REST API from a personal script, running a notebook. For CI/CD or shared automation, use a service account instead - a PAT is revoked when your account is deprovisioned, which would break the automation.
- Where to create: User settings → Access tokens. Set a name and an expiry; the value is shown once.
- Use: username = your e6data email, password = the PAT; or send
Authorization: Bearer <PAT>.
- Audit: PAT-authenticated requests appear in Run History (with the PAT name as the access method).
Service account keys (e6sa_)
A service account is a non-human identity scoped to a single workspace, authenticating with an e6sa_ API key and governed by the same roles as users. Use it for CI/CD and scheduled jobs.
The token format is e6sa_<workspace>_<keyId>_<secret> - the prefix is checked before any lookup, the workspace segment scopes it, and the secret is shown once. A service account can hold multiple keys (rotate freely); deleting the account revokes all its keys and removes its bindings. Service accounts are created and managed as described in Users, groups, and service accounts.
Grant a service account the minimum role it needs, use one per system, and rotate keys with create-before-delete. See Token security best practices.
See also
Last modified on October 1, 2026
