---
title: How to manage service accounts
sidebarTitle: Manage service accounts
description: Workspaces are isolated environments for flows and deployments within Prefect Cloud.
---

Service accounts enable you to create a Prefect Cloud API key that is not associated with a user account.
Service accounts are typically used to configure API access for running workers or executing deployment flow runs on remote infrastructure.

Service accounts are non-user accounts that have the following features:

- Prefect Cloud [API keys](/v3/how-to-guides/cloud/manage-users/api-keys)
- [Roles](/v3/how-to-guides/cloud/manage-users/manage-roles) and permissions

With service account credentials, you can
[configure an execution environment](/v3/manage/cloud/connect-to-cloud/#configure-a-local-execution-environment)
to interact with your Prefect Cloud workspaces without a user manually logging in from that environment.
Service accounts may be created, added to workspaces, have their roles changed, or deleted without affecting other user accounts.
You may apply any valid _workspace-level_ role to a service account.

Select **Service Accounts** to view, create, or edit service accounts.

Service accounts are created at the account level, but individual workspaces may be shared with the service account.
See [workspace sharing](/v3/manage/cloud/workspaces/#workspace-sharing) for more information.

<Tip>
**Service account credentials**

When you create a service account, Prefect Cloud creates a new API key for the account and provides the
API configuration command for the execution environment.
Save these to a safe location for future use.
If the access credentials are lost or compromised, regenerate them from the service account page.
</Tip>

## Create a service account

On the **Service Accounts** page, select the **+** icon to create a new service account. Configure:

- The service account name. This name must be unique within your account.
- An expiration date, or the **Never Expire** option.

<Note>
**Service account roles**

A service account may only be a Member of an account.
You may apply any valid _workspace-level_ role to a service account when it is
[added to a workspace](/v3/manage/cloud/workspaces/#workspace-sharing).
</Note>

Select **Create** to create the new service account.

<Warning>
Copy the key to a secure location since an API key cannot be revealed again in the UI after it is generated.
</Warning>

Change the API key and expiration for a service account by rotating the API key.
Select **Rotate API Key** from the menu on the left side of the service account's information on this page.
Optionally, you can set a period of time for your old service account key to remain active.

To delete a service account, select **Remove** from the menu on the left side of the service account's information.
