Service accounts are non-human identities that allow applications and services to authenticate with Black Duck Portal using the OIDC client credential flow. Unlike traditional service accounts that provide scoped API tokens, these service accounts use standard OAuth 2.0/OIDC protocols to obtain short-lived access tokens for machine-to-machine authentication.
When to use service accounts
Use service accounts for server-to-server integrations where no user interaction is required. They enable your applications interact with secure API endpoints hosted in Black Duck products and tools, without exposing user credentials or maintaining long-lived API keys.
How service accounts work
Service accounts use industry-standard OAuth 2.0/OIDC protocols for authentication:
- Create a service account in Black Duck Portal and retrieve its credentials (Client ID, Client Secret, and Tenant ID).
- Your application sends these credentials to the authentication endpoint to request an access token.
- The endpoint returns a short-lived access token (valid for 24 hours).
- Your application includes this token in the authorization header when calling APIs.
- When the token expires, your application requests a new one using the same credentials.
Key concepts
Authentication flow
Service accounts use the OIDC client credential grant flow for authentication. Your application presents the service account's credentials (Client ID and Secret) to the token endpoint, receives a short-lived access token, and uses that token to authenticate API requests. When the token expires, your application requests a new one using the same credentials.
Access tokens
Access tokens are bearer tokens that grant your application access to Black Duck Portal APIs. Tokens are valid for 24 hours (86400 seconds) from the time they are issued. Your application must include the access token in the authorization header of API requests. After a token expires, your application must request a new token using the service account credentials.
Client ID
The Client ID is a unique identifier for the service account. It is used together with the Client Secret to authenticate your application when requesting access tokens. The Client ID is not confidential and can be included in client-side code or configuration files.
Tenant ID
The Tenant ID identifies your organization within Black Duck Portal. It is required when requesting access tokens and ensures that service accounts can only authenticate within their designated organization scope.
Client Secret
The Client Secret is a confidential credential used to authenticate the service account. The secret is paired with the Client ID when requesting access tokens from the authentication endpoint. Unlike access tokens which expire after 24 hours, Client Secrets do not automatically expire and remain valid until manually rotated. Client Secrets must be kept secure and should never be exposed in client-side code, public repositories, or logs. We strongly recommend rotating secrets every 30-90 days to minimize the risk of unauthorized access if a secret is compromised.
Audiences
An audience specifies the target API or service that the service account is authorized to access. When you create a service account, you can optionally select an audience to limit the scope of where the account's credentials can be used. The audience value is included in access tokens and verified by the target service to ensure tokens are used only for their intended purpose.