Personal access tokens and the security audit log are now generally available, and API keys are now called service accounts. Together, these changes give you tighter control and clearer traceability over who can access your projects, helping you meet enterprise-level security and governance requirements.

Service accounts (formerly API keys)

API keys are now called service accounts. The name better reflects what they are: machine identities that represent an application or integration rather than a person. They remain the recommended credential for production integrations, CI/CD pipelines, and server-side use cases that should survive personnel changes.

This is a naming change only. Existing credentials keep working, and the UNIFORM_API_KEY and UNIFORM_CLI_API_KEY environment variable names are unchanged for both credential types.

Learn more in the service accounts guide.

Personal access tokens

Personal access tokens (PATs) are API credentials tied to your user account, so a token represents you and stays scoped to your current permissions.

• Owner-capped permissions: a token can only hold roles you currently have. If your roles are reduced, the token's roles are automatically pruned to match.
• Per-user limit: up to 10 PATs per team.

PATs are ideal for developer tooling that acts on your behalf, such as the Uniform MCP Server, the Uniform Context Chrome extension, and local development scripts.

Learn more in the personal access tokens guide.

Credential management improvements

These improvements apply to both service accounts and personal access tokens.

• Expiration: service accounts and personal access tokens can now be set to expire.
• Key identification: newly created keys display the last four characters of their value, making it easier to match a key name to its value. Existing keys are unaffected.

Security audit log

The security audit log records security-related events and changes for your team, so admins can track who created or deleted credentials, modified roles, or changed team membership.

• Administrative events: credential creation and deletion, role and policy changes, membership updates, and more.
• Delegation events: identity delegation token operations (session token minting and refresh), shown in a separate tab.
• 30-day retention: entries are kept for 30 days and then automatically removed.
• Filtering: narrow results by user and by action, and combine filters. For actions performed with a personal access token, entries resolve to the token's owner for easy attribution.

Team admin access is required to view the audit log, under Security > Audit Log.

Learn more in the security audit log guide.

Getting started

Head to your team's Security settings to create a service account or personal access token and review recent activity in the audit log. For an overview of which credential to use when, see the API access guide.