Personal access tokens and service account keys
The two e6data credential types in detail - personal access tokens and service account keys - their formats and when to use each.
e6data has two credential types. This page covers each in detail; for the at-a-glance comparison, see the canonical table in Access tokens. For step-by-step creation, see Create, use, rotate, and revoke tokens.
Personal Access Token (PAT)
e6pat_
A human user
The user's roles
Service Account API key
e6sa_
A workspace-scoped machine identity
The service account's roles
Personal access tokens (e6pat_)
A PAT authenticates the API as you and inherits exactly your roles in the workspace. Use a PAT for your own scripts, notebooks, and BI tool connections.
When to use: connecting a BI tool over JDBC, calling the REST API from a personal script, running a notebook. For CI/CD or shared automation, use a service account instead - a PAT is revoked when your account is deprovisioned, which would break the automation.
Where to create: User settings → Access tokens. Set a name and an expiry; the value is shown once.
Use: username = your e6data email, password = the PAT; or send
Authorization: Bearer <PAT>.Audit: PAT-authenticated requests appear in Run History (with the PAT name as the access method).
Service account keys (e6sa_)
A service account is a non-human identity scoped to a single workspace, authenticating with an e6sa_ API key and governed by the same roles as users. Use it for CI/CD and scheduled jobs.
The token format is e6sa_<workspace>_<keyId>_<secret> - the prefix is checked before any lookup, the workspace segment scopes it, and the secret is shown once. A service account can hold multiple keys (rotate freely); deleting the account revokes all its keys and removes its bindings. Service accounts are created and managed as described in Users, groups, and service accounts.
Grant a service account the minimum role it needs, use one per system, and rotate keys with create-before-delete. See Token security best practices.
See also
Access tokens - the canonical token-types table.
Last updated
Was this helpful?