> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/platform-administration/service-accounts/choose-a-service-account-type-to-use-with-snyk-apis.md).

# Choose a service account type to use with Snyk APIs

How to choose a Snyk service account type and level, based on the permissions your API automation needs

## Group level or Organization level

Each Snyk action, whether for the Snyk API or the Snyk Web UI, requires a set of [user permissions](/platform-administration/user-management/user-roles.md).

The permissions granted to a service account depend on the user role type it is assigned. For example, an Organization-level service account can use Organization-level roles, and a Group-level service account can use Group-level roles.

## Authentication types

#### Access tokens

Service accounts use Snyk [access tokens](/developer-tools/snyk-api/authentication-for-api/personal-access-tokens-pats.md) to secure your workflow. You control when the service account is created and can se the expiry date. The maximum expiry for an access token service account is one year, and on expiration you must create a new service account to continue using this authentication method.

Use an [OAuth 2.0 service account](/platform-administration/service-accounts/service-accounts-using-oauth-2.0.md) instead of an access token service account, to prevent downtime when a token expires if you are using automation, for example, CI/CD pipeline.

#### OAuth 2.0

Service accounts have associated OAuth 2.0 client credentials that can fetch an OAuth 2.0 access token. These offer the highest level of security due to the short time-to-live of an OAuth access token and the standardized, automated refresh process.

{% hint style="info" %}
For more details on implementing this type of service account, visit [Service accounts using OAuth 2.0](/platform-administration/service-accounts/service-accounts-using-oauth-2.0.md).
{% endhint %}

#### API key (legacy)

The service account has a Snyk API key associated with it. API keys are quick to implement in a workflow and do not expire. Due to the risk of a token which does not expire, this option is not recommended.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.snyk.io/platform-administration/service-accounts/choose-a-service-account-type-to-use-with-snyk-apis.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.