Management automation

Use ManagementClient only for Account administration with a Service Account. It exchanges the server-side Service Account secret for a short-lived, permission-bounded management token using client_secret_basic; it cannot invoke MCP or inherit User authority.

TypeScript

import { ManagementClient } from "@axec/sdk/management";

const management = new ManagementClient({
  baseUrl: "https://axec.example",
  account: "acme",
  clientId: process.env.AXEC_SERVICE_ACCOUNT_ID!,
  clientSecret: process.env.AXEC_SERVICE_ACCOUNT_SECRET!,
});

const { applications } = await management.workspaceApi().applications();

Python

import os

from axec_sdk import ManagementClient

async with ManagementClient(
    base_url="https://axec.example",
    account="acme",
    client_id=os.environ["AXEC_SERVICE_ACCOUNT_ID"],
    client_secret=os.environ["AXEC_SERVICE_ACCOUNT_SECRET"],
) as management:
    applications = await management.workspace_api().applications()

Each operation requests only the permission scopes its route declares, combined into the cached token. Axec expands a declared write scope with its same-resource read and rejects a request that exceeds the Service Account ceiling. Both clients cache the short-lived management bearer and refresh it before expiry; refresh after credential rotation and keep the long-lived credential and bearer server-side.

The management interface provides Account inventory and lifecycle operations, including Applications, Connectors, Dependencies, Connections, Service Accounts, and security activity. Treat one-time issued Service Account credentials as secrets: move them directly to secret storage, never logs or serialized state.

See Automate management with a Service Account for least privilege, rotation, immediate restriction, and evidence verification.

Continue

• Review Service Account lifecycle before issuing or rotating credentials.
• Review Security Architecture to understand the secret-free evidence boundary.
• Autonomous gateway access when the next workload needs MCP capability invocation rather than Account administration.