# Service Access Tokens


This guide explains the concept of **Service Access Tokens** in RudderStack's Access Management system. It also describes the steps to generate them and manage their permissions.

## Overview

A **Service Access Token** (SAT) enables applications to access RudderStack APIs. It provides a flexible, secure, and centralized way for you to programmatically interact with resources and services in the RudderStack platform.

Unlike [Personal Access Tokens]({{< ref "access-management/personal-access-tokens.md" >}}) which are tied to individual users, SATs provide centralized access to resources within an organization or workspace, ensuring continuity and reducing the risk of disruptions when members are removed or their [roles]({{< ref "access-management/member-management.md#member-roles" >}}) change.

Operations performed with SATs are logged and audited against the SAT, ensuring that activities are traceable to the token rather than an individual user.

## Personal Access Tokens vs. Service Access Tokens

| Personal Access Tokens (PAT) | Service Access Tokens (SAT)  |
| :------| :-----|
| Tied to a specific user within a workspace. |  Not tied to an individual user. |
| Used for individual tasks and testing. | Used for centralized, shared access and production use cases.  |
| Any processes dependent on these tokens will break if the user is removed from the organization or a breaking change is made to their permissions. | Exist at an organization or workspace level, ensuring continuity in essential workflows and pipelines using these tokens. |

{{< info >}}
RudderStack recommends using:

- SATs for your **production** use cases that require shared access to the services and resources across the organization or workspace. 
- PATs for **testing** a service/feature or **personal** use cases.
{{< /info >}}

## Service Access Token types

You can generate the following two types of SATs in RudderStack:

### Organization-level SATs

Organization-level SATs are associated with the entire organization and have [Admin]({{< ref "access-management/member-management.md#member-roles" >}}) permissions by default.

You can use them **only** for authenticating your [SSO SCIM]({{< ref "user-guides/sso-setup/" >}}), [Audit Log API]({{< ref "api/audit-logs-api.md" >}}), and [Organization Usage API]({{< ref "api/organization-usage-api.md" >}}).

### Workspace-level SATs

Workspace-level SATs are linked to a specific workspace. Their usage is restricted to workspace-level resources (sources, destinations, transformations, Tracking Plans, etc.) and APIs.

{{< warning >}}
You cannot use workspace-level SATs to interact with organization-level functionalities like Audit Logs, Organization Usage API, or SCIM provisioning.
{{< /warning >}}

## Generate Service Access Token

1. Go to **Settings** > **Access Management** > **Service Access Tokens**.

{{< info >}}
Only [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) can see the **Service Access Tokens** tab and **create** or **delete** Service Access Tokens.
{{< /info >}}

{{< image src="images/access-management/service-access-tokens/sat-tab.webp" alt="Service Access Tokens tab in RudderStack dashboard" >}}

2. Click the **Organization** or **Workspace** tab depending on whether you want to generate an [organization-level SAT](#organization-sat) or [workspace-level SAT](#workspace-sat).

### Organization SAT

1. In the **Organization** tab, click **Generate new token**.
2. Enter the name of the SAT and click **Generate**.

{{< image src="images/access-management/service-access-tokens/org-sat-generate.webp" alt="Generate organization level Service Access Token in RudderStack dashboard" >}}

3. Note the token value.

{{< warning >}}
Secure the token — you will not be able to see it again once you click **Close**.
{{< /warning >}}

{{< image src="images/access-management/service-access-tokens/org-sat-token.webp" alt="Organization level Service Access Token generated in RudderStack dashboard" >}}

### Workspace SAT

1. Under **Service Access Tokens**, click the **Workspace** tab.

{{< image src="images/access-management/service-access-tokens/workspace-tab.webp" alt="Workspace tab in Service Access Tokens section" >}}

2. Click **Generate new token**.
3. Enter the name of the SAT.
4. Choose the relevant workspace (applicable for a multi-workspace organization) where the token will be applicable. Then, click **Next**.

{{< image src="images/access-management/service-access-tokens/workspace-sat-name.webp" alt="Workspace level Service Access Token generation in RudderStack dashboard" >}}

5. Under **Workspace SAT access policy**, configure the [access policy]({{< ref "access-management/policies-overview.md#resource-permissions" >}}) for the token.

{{< warning >}}
**Important**: Once generated, you cannot edit the access policy of the workspace-level Service Access Token.
{{< /warning >}}

{{< image src="images/access-management/service-access-tokens/workspace-sat-policy.webp" alt="Workspace level Service Access Token access policy in RudderStack dashboard" >}}

6. Click **Generate** to generate the token.
7. Note the token and use it in the relevant workspace-level APIs and services.

{{< warning >}}
Secure the token value — you will not be able to see it again once you click **Close**.
{{< /warning >}}

{{< image src="images/access-management/service-access-tokens/workspace-token-generated.webp" alt="Workspace level Service Access Token generated in RudderStack dashboard" >}}

## Migration of old Service Access Tokens

When you [migrate to the new Access Management system]({{< ref "access-management/migration-steps.md" >}}), the previously-created Service Access Tokens are automatically imported with their current permissions.

See the [Migration Scenarios]({{< ref "access-management/migration-examples/" >}}) guide for detailed examples of how Service Access Tokens are migrated to the new Access Management system.

<br />