Service account key format

The structure of an e6data service account API key and how it's stored.

A service account API key is a four-part, underscore-separated string carrying a workspace-scoped machine identity.

e6sa_<workspace>_<keyId>_<secret>

Segment	Meaning
e6sa_	The service-account prefix - checked before any lookup
<workspace>	The workspace the key is scoped to (keys don't span workspaces)
<keyId>	The key's identifier
<secret>	The secret material

• The full value is shown once, at creation; the secret is stored hashed and cannot be retrieved again.
• A service account can hold multiple keys (rotate freely). Deleting the service account revokes all its keys.
• Like a PAT, the key carries identity only - permissions come from the service account's role bindings.

The other prefix is e6pat_ (personal access token). See the canonical token-types table.

See also

• Personal access token format
• Token lifecycle states
• Users, groups, and service accounts