Service accounts

Connect an agent to a World without having it act as a person.

A service account is an identity that belongs to one World. Use it for an agent that works for the team, such as an integration, rather than for one member. It has its own credentials, Sessions, and agent connections, and Podclave records what it does as the service account.

How it differs from a personal connection

A personal connection acts as you, in the Worlds that you choose; you can add or remove Worlds later. It uses your wallet, and you manage it on Account → Agent connections.

A service account connection acts as the service account, in its own World only. It uses the service account’s wallet, and World admins manage it on the World’s Service accounts page.

Either kind sees only the Sessions of the identity it acts as. Neither can see other members’ private Sessions or change World settings, members, or repositories.

Who manages a service account

Only a World’s admins can create, manage, disable, and enable its service accounts, on World → Agent access → Service accounts. A service account is a member of its World and a user of the World’s Lab. It is never an admin, and it cannot create a Lab, accept invitations, or receive a World transfer. It never signs in and never receives email.

The Service accounts page shows each account’s active connections, who approved each one, and recent activity with the admin who did it.

Manage its credentials

A service account starts with an empty wallet. To add credentials, select Manage credentials for the account. Your browser then works as the service account:

• A yellow banner names the service account, its World, and you, with a link to the World and an Exit button.
• You can move around Podclave as usual. Each page allows only what the service account itself may do; a page outside its rights gives the usual “not available” result. Your own admin rights are never used.
• Credentials that you add belong to the service account, and Podclave records them with your name. A provider sign-in links whichever provider account your browser uses at that moment, so sign in with the service account’s provider identity. Nothing is copied from your own wallet.
• You cannot approve an agent connection while you manage a service account.

Select Exit to return to your own account. Management also ends when you sign in or out, add or switch an account, lose admin rights in the World, or when the service account is disabled.

Connect an agent as a service account

1. Add https://podclave.com/mcp to the agent as an MCP connector. See Connect your agents.
2. On Podclave’s consent page, choose the service account as the identity. Only the World’s admins see this choice, and only for the service accounts of that World.
3. Check the agent’s name and return address, and approve.

The connection works only in the service account’s World. Podclave records the admin who approved it. A Session that the agent starts uses the service account’s own credentials. It uses the Lab’s funding only when the request asks for Lab funding and the World allows Lab funding for agents. Podclave never uses a person’s credentials for a service account.

Revoke, disable, and enable

• Revoke a connection on the Service accounts page. It stops at once.
• Disable the service account to stop all of its connections for good. Its files, Workspaces, and Sessions stay.
• Enable it again to use it later. Earlier connections stay revoked, so connect the agent again.
• When a World moves to another Lab, its service accounts are disabled. An admin enables each one again and connects again.

Get help

Write to hello@podclave.com.