Service accounts

A service account is an identity for a program that works without a person present, such as a scheduled job. It reaches patchnet.ai over MCP with its own credentials. This page is for organization admins.

A service account does not sign in to the browser. It does not inherit the rights of the admin who created it. It can only reach the workspaces you grant it, with the role you choose.

Service accounts are turned on per organization. If you do not see Service accounts under Settings → My org, ask Patchnet support to turn them on.

Set one up

Each service account opens on three parts: Account, Permissions and Credentials.

1. Open Settings → My org → Service accounts and enter a name for the new account, pick the accountable administrator, and choose Create account.
2. Under Permissions, grant it Read or Read and write on each workspace it needs. You can only pick workspaces you manage.
3. Under Credentials, add a client and choose how it proves who it is: a client secret, or a public key.
4. For a secret, copy it when it is shown, because it appears once. For a public key, register the public half only. Keep the secret or private key in a secret store, never in a file you share.
5. Give the client ID and the secret or private key to the program through its environment.

The program exchanges its credentials for a short-lived token and asks for a new one when it expires. It reads by default and must ask for write access to write. Credentials expire after 90 days, and the page shows recent activity.

What a service account can do

A service account can use the core document tools: help, list workspaces, view document types, list, query, get and search documents, and create and update documents. It cannot manage workspaces, access, or reports.

Documents it writes show the service account as their creator and updater, never the admin. Every write is also recorded in the workspace's activity.

Rotate a credential

Choose Rotate on the client. By default, rotating stops the current secret or key at once, so anything using it stops working. To switch without downtime, tick Keep the current secret working until I revoke it (or key), switch the program to the new credential, check that it shows recent activity, then revoke the old one. Revoking, removing access, or disabling an account stops the access it gave. Turning an account back on does not bring back revoked credentials.

Limits

Each account has a limit on how often it can call, and its writes count toward your organization's write limits. See Limits.

See also

• Roles and access
• MCP tools reference