Service accounts are non-human identities that allow applications and services to authenticate with Black Duck products (e.g. Black Duck Portal) using the OIDC client credential flow. Unlike traditional service accounts that provide scoped API tokens, these service accounts use standard OAuth 2.0/OIDC protocols to obtain short-lived access tokens for machine-to-machine authentication. If you need more details about service accounts fields, see the Glossary.
When to use service accounts
Use service accounts for server-to-server integrations where no user interaction is required. They enable your applications interact with secure API endpoints hosted in Black Duck products and tools, without exposing user credentials or maintaining long-lived API keys.
How service accounts work
Service accounts use industry-standard OAuth 2.0/OIDC protocols for authentication:
- Create a service account in Black Duck Portal and retrieve its credentials (Client ID, Client Secret, and Tenant ID).
- Your application sends these credentials to the authentication endpoint to request an access token.
- The endpoint returns a short-lived access token (valid for 24 hours).
- Your application includes this token in the authorization header when calling APIs.
- When the token expires, your application requests a new one using the same credentials.