Service Accounts

Service accounts are non-human credentials for automation — CI pipelines, scheduled jobs, and integrations that need to call NVIDIA CCluster APIs without a browser login. Each service account has a Client ID and Client Secret you use to authenticate programmatically.

Service accounts are scoped to the user who creates them and the organization they belong to. You only see and manage service accounts you created in your current organization. API calls made with a service account run as that user within that organization — they cannot access resources in other organizations or service accounts created by other users.

Service accounts authenticate to NVIDIA CCluster platform APIs (for example, listing deployments or creating workloads through the SDK). They are separate from Vault bearer tokens, which protect your deployed inference endpoints. See Securing Endpoints for endpoint access.

Prerequisites

Before creating a service account, you need:

• An active NVIDIA CCluster account provisioned for your organization
• Access to the organization where the automation will run — service accounts are tied to your user and that organization
• Permissions for the scopes you want to grant — you can only assign scopes you already hold

Create a service account

1. Log in to the NVIDIA CCluster UI.
2. Select Service Accounts from the sidebar.
3. Click Create service account.
4. Enter a Name (required) and optional Description — for example, CI pipeline or nightly-evaluation.
5. Select the Scopes your automation needs. Only scopes you hold are available; UI-only permissions are not grantable.
6. Click Create.

After creation, a modal displays your Client Secret. Copy and store it immediately — this is the only time the full secret is shown.

The service account list also shows the Client ID for each account. You can copy it at any time from the list.

Use service account credentials

Store the Client ID and Client Secret in a secret manager or your CI/CD secret store. Never commit them to source control.

For unattended automation with the centml SDK or CLI, set the following environment variables:

export CENTML_SERVICE_ACCOUNT_ID="<your_client_id>"
export CENTML_SERVICE_ACCOUNT_SECRET="<your_client_secret>"

The SDK uses these credentials to obtain an access token automatically — no browser login required. Once configured, use the client as you would after an interactive centml login:

ccluster ls

import centml
from centml.sdk.api import get_centml_client
from centml.sdk import DeploymentType

with get_centml_client() as cclient:
    deployments = cclient.get(DeploymentType.INFERENCE_V2)
    print(deployments)

Use one service account per automation or integration so you can rotate or revoke credentials independently.

Manage service accounts

From the Service Accounts page, you can:

Action	Description
Edit	Update the name, description, or scopes
Regenerate secret	Generate a new Client Secret (shown once) — use this to rotate credentials
Delete	Permanently remove the service account

Deleting a service account takes effect immediately. Any integration using its credentials will stop working.

When you regenerate a secret, copy the new value right away. The previous secret may continue to work until you rotate integrations to the new one.

Security best practices

• Least privilege — grant only the scopes your automation needs.
• One account per use case — separate CI, staging, and production automations.
• Rotate regularly — regenerate secrets on a schedule or after team changes.
• Store secrets securely — use a secret manager or CI secret store, not environment files in your repository.
• Revoke promptly — delete service accounts when an integration is retired.

API requests made with a service account are attributed to the user who created it and that user's organization.

Limits and important notes

• You can create at most 5 active service accounts per user per organization.
• Service accounts belong to the creating user and current organization — switch organizations in the UI to manage accounts for a different org, or have each team member create their own accounts.
• The Client Secret is shown only once at creation or regeneration — if you lose it, generate a new secret.
• You cannot grant scopes you do not hold.
• Scopes are fixed at creation time based on your permissions when you create or update the account; if your role changes later, review and update service account scopes as needed.

What's next

Client Setup

Install and configure the NVIDIA CCluster client.

Python SDK Reference

Access NVIDIA CCluster programmatically using Python.

Managing Vault Objects

Generate bearer tokens and other secrets for deployments and endpoints.