Service Accounts

Service accounts enable programmatic access to your APIs without user credentials. Use them for server-to-server communication, CI/CD pipelines, and automated scripts.

What Are Service Accounts?

Unlike regular user accounts, service accounts:

• Are not tied to any specific user
• Are created at the API level
• Support multiple secrets with configurable expiration

Creating a Service Account

1. Sign in to the Developer Portal
2. Navigate to your API
3. Go to Team → Service Accounts
4. Click Create Service Account

Managing Secrets

Each service account can have multiple secrets:

Property	Description
Client ID	Unique identifier for the service account
Client Secret	The secret used for authentication
Expiration	Default 2 years from creation (optional)
Status	Can be enabled or disabled

tip

Create multiple secrets to enable rotation without downtime. Disable old secrets before deleting them.

Getting a Bearer Token

To authenticate, POST your credentials to the authentication endpoint:

const response = await fetch("https://system.restapi.com/System/UserAccount", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    clientId: "your-client-id",
    clientSecret: "your-client-secret",
  }),
});

const { token } = await response.json();

Using the Token

Include the bearer token in subsequent API requests:

const data = await fetch("/api/your-collection", {
  headers: {
    Authorization: `Bearer ${token}`,
  },
});

Complete Example

async function fetchData() {
  // 1. Get bearer token
  const authResponse = await fetch(
    "https://system.restapi.com/System/UserAccount",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        clientId: process.env.RESTAPI_CLIENT_ID,
        clientSecret: process.env.RESTAPI_CLIENT_SECRET,
      }),
    },
  );

  const { token } = await authResponse.json();

  // 2. Make authenticated API request
  const dataResponse = await fetch("/api/products", {
    headers: {
      Authorization: `Bearer ${token}`,
    },
  });

  return dataResponse.json();
}

Best Practices

• Store secrets securely — Use environment variables, not code
• Rotate secrets regularly — Create new secrets before old ones expire
• Use least privilege — Grant only the access each service account needs
• Monitor usage — Review service account activity in the portal
• Disable unused accounts — Remove or disable accounts that are no longer needed

Security Considerations

warning

Never commit client secrets to source control. Use environment variables or a secrets manager.

Service account secrets should be treated like passwords:

• Don't share them in plain text
• Don't log them
• Rotate them if they may have been exposed