A job, a CI run, or an agent is not a user. If you put a person's session cookie or personal token in that process, you cannot revoke the workload without locking the person out, and a prompt or a log can leak a human credential.
Give the workload its own credential. Pick one. Don't stack two for the same process.
| Use this | When |
|---|---|
| M2M application | The project is the workload. No human users. OAuth 2.0 client_credentials. |
| Agents entry | A named agent calls APIs or MCP tools inside a project that also has users. You need verify, revoke, and allowed tools. |
| Service account | Organization-owned automation through the REST API, not the Agents module. |
| Personal access token | One person's script on their own machine. It dies with that person. |
The full create-and-call steps are in Machine identity. AgentSec is the longer story for agents that both sign in and call tools.
What the token is
An M2M or agent client exchanges its client id and secret at the environment token endpoint and receives a short-lived bearer. There is no refresh token. The process repeats the exchange before expires_in.
The resource server validates that bearer the same way it validates a user token, then authorizes the action. A valid machine token names a caller. It does not grant every route.
The client secret is shown once at creation. It stays in the process that calls the token endpoint. It does not go in a prompt, a tool description, a graph state, or a frontend bundle. The public key (pk_...) is the value that is safe to ship in an app that only verifies tokens.
When something leaks
Revoke the agent in Agents when the subject is the OIDC client id. New tokens fail. A JWT that was already issued stays valid until expires_in unless the resource server enforces the trust store.
A leaked client secret is the same class of incident as a leaked signing key: replace it, using Rotate your API keys, and assume any token minted with the old secret is hostile until it expires.
Don't reuse one M2M application across environments or across unrelated jobs. One secret should not be able to mint tokens for everything you run.
Related
| Read | To learn how to |
|---|---|
| Machine identity | Create the client and exchange credentials |
| AgentSec | Sign agents in and govern tool calls |
| Rotate your API keys | Replace a leaked client secret |
| Authorization | Decide what that machine may do |