API access
Uniform provides two types of API credentials for authenticating applications and tools:
| Service accounts | Personal access tokens | |
|---|---|---|
| Identity | Machine identity, independent of any user | Tied to a specific user's account |
| Permissions | Assigned roles (per-project and/or team admin) | Assigned roles, capped to the owner's current roles |
| Lifecycle | Survives personnel changes; persists until deleted | Tied to the owner's access; revoked when the owner loses access |
| Expiration | Optional expiration date | Optional expiration date |
| Team admin support | Yes | No |
| Limit | No per-user limit | 10 per user per team |
| Primary use cases | Integrations, CI/CD pipelines, server-side applications | MCP server, Chrome extension, local development, personal tooling |
Service accounts (formerly API keys)#
Service accounts are machine identities that represent an application or integration rather than a person. They are the recommended credential for production integrations, CI/CD pipelines, and any server-side use case where the credential should not be tied to an individual.
Learn more about service accounts
Personal access tokens#
Personal access tokens (PATs) are credentials tied to your user account. Each token can only be assigned roles you currently hold in the relevant project, ensuring tokens never exceed your own access level.
PATs are ideal for developer tooling that acts on your behalf, such as the Uniform MCP Server, the Uniform Context Chrome extension, or local development scripts.
Learn more about personal access tokens
When to use which#
- Use a service account when the credential represents a system or process (not a person), when it needs to outlive team membership changes, or when team admin access is required.
- Use a personal access token when the credential represents you personally, when you want token permissions to automatically stay within your own access level, or for developer tooling on your local machine.
Auditing and traceability#
All credential operations (creation, deletion, and permission changes) are recorded in the Security audit log, accessible to team admins under Security > Audit Log. The audit log retains events for 30 days.
Each entry identifies the acting identity and the affected credential. For actions performed with a personal access token, the audit log resolves the token to its owner for easy attribution.
info
The UNIFORM_API_KEY and UNIFORM_CLI_API_KEY environment variable names remain unchanged for both credential types. These names are preserved for backwards compatibility regardless of whether the credential is a service account or a personal access token.