Skip to content
AxecAxec Docs

Automate management with a Service Account

This example runs one bounded task: list Applications in one tenant. A Service Account is a named non-human management principal. It has no User role, Application gateway authority, Connection, or Grant authority and cannot invoke MCP.

Provision least privilege

Section titled “Provision least privilege”

Ask a tenant administrator to create an active Service Account whose permission ceiling contains only applications:read, then issue a credential. Axec returns the axec_sa_ secret once and stores only its password-resistant hash and safe fingerprint.

Store the client ID and secret in server-side secret storage. Never ship them to a browser, log them, or use the long-lived secret as a management API bearer.

Run the task

Section titled “Run the task”
import { ManagementClient } from "@axec/sdk/management";


const management = new ManagementClient({
  baseUrl: "https://axec.example.com",
  tenant: "acme",
  clientId: process.env.AXEC_SERVICE_ACCOUNT_ID!,
  clientSecret: process.env.AXEC_SERVICE_ACCOUNT_SECRET!,
  permissions: ["applications:read"],
});


const { applications } = await management.tenantApi().applications();
console.log(
  applications.map(({ key, name, status }) => ({ key, name, status })),
);

The SDK sends the secret only to /oauth2/token using client_secret_basic. It requests the canonical management audience, https://axec.example.com/api/v1/ws/acme, and the explicit applications:read permission. Axec rejects permission widening instead of silently issuing a narrower token and returns a no-store, short-lived management bearer.

Rotate without downtime

Section titled “Rotate without downtime”
  1. Issue a second credential while the first is still active.
  2. Deploy the new secret to the workload and force a token refresh with management.refresh().
  3. Confirm the bounded inventory call succeeds with the new credential.
  4. Revoke the exact old credential generation.

Overlapping active generations keep rotation available while preserving exact credential attribution. After revocation, Axec rejects the next request made with a token bound to the old credential; it does not wait for JWT expiry. Disabling the Service Account or removing applications:read has the same immediate live-authority effect.

Verify evidence

Section titled “Verify evidence”

Inspect tenant security evidence for token issuance and the management request. It should identify the tenant, Service Account, exact credential generation, permission or route category, outcome, and correlation ID. It must not contain the plaintext secret, its hash, a complete bearer token, or an Authorization header.

Use an autonomous Application for MCP work and delegated authority for work performed for a User.

Continue

Section titled “Continue”