// Module included in the following assemblies:
//
// * authentication/using-service-accounts.adoc

:_mod-docs-content-type: CONCEPT
[id="service-accounts-overview_{context}"]
= Service accounts overview

[role="_abstract"]
You can use {product-title} service accounts to allow a {product-title} component to
directly access the API. 

Service accounts are API objects that exist within each project that provide a flexible way to control API
access without sharing a regular user's credentials.

When you use the {product-title} CLI or web console, your API token
authenticates you to the API. You can associate a component with a service account
so that they can access the API without using a regular user's credentials.
ifdef::openshift-online,openshift-origin,openshift-enterprise,openshift-webscale[]

For example, service accounts can allow:

* Replication controllers to make API calls to create or delete pods
* Applications inside containers to make API calls for discovery purposes
* External applications to make API calls for monitoring or integration purposes
endif::[]

Each service account's user name is derived from its project and name:

[source,text]
----
system:serviceaccount:<project>:<name>
----

Every service account is also a member of two groups:

[cols="1,2",options="header"]
|===

|Group
|Description

|system:serviceaccounts
|Includes all service accounts in the system.

|system:serviceaccounts:<project>
|Includes all service accounts in the
specified project.

|===
