> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Personal access tokens and service account keys

> The two e6data credential types in detail - personal access tokens and service account keys - their formats and when to use each.

e6data has two credential types. This page covers each in detail. For step-by-step creation, see [Create, use, rotate, and revoke tokens](/platform/tokens/create-rotate-revoke).

| Type | Prefix | Identity | Authorization |
| - | - | - | - |
| Personal Access Token (PAT) | `e6pat_` | A human user | The user's roles |
| Service Account API key | `e6sa_` | A workspace-scoped machine identity | The service account's roles |

## Personal access tokens (`e6pat_`)

A PAT authenticates the API **as you** and inherits exactly your roles in the workspace. Use a PAT for your own scripts, notebooks, and BI tool connections.

* **When to use:** connecting a BI tool over JDBC, calling the REST API from a personal script, running a notebook. For CI/CD or shared automation, use a service account instead - a PAT is revoked when your account is deprovisioned, which would break the automation.
* **Where to create:** **User settings → Access tokens**. Set a name and an expiry; the value is shown once.
* **Use:** username = your e6data email, password = the PAT; or send `Authorization: Bearer <PAT>`.
* **Audit:** PAT-authenticated requests appear in Run History (with the PAT name as the access method).

## Service account keys (`e6sa_`)

A service account is a non-human identity **scoped to a single workspace**, authenticating with an `e6sa_` API key and governed by the same roles as users. Use it for CI/CD and scheduled jobs.

The token format is `e6sa_<workspace>_<keyId>_<secret>` - the prefix is checked before any lookup, the workspace segment scopes it, and the secret is shown once. A service account can hold multiple keys (rotate freely); deleting the account revokes all its keys and removes its bindings. Service accounts are created and managed as described in [Users, groups, and service accounts](/platform/identity/users-groups-service-accounts).

Grant a service account the minimum role it needs, use one per system, and rotate keys with create-before-delete. See [Token security best practices](/platform/tokens/best-practices).

## See also

* [Create, use, rotate, and revoke tokens](/platform/tokens/create-rotate-revoke)
* [Token security best practices](/platform/tokens/best-practices)
* [Users, groups, and service accounts](/platform/identity/users-groups-service-accounts)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.