> ## Documentation Index
> Fetch the complete documentation index at: https://docs.m3ter.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Creating and Configuring Service Users
*Service Users* represent the automated processes you want to grant access to your Organization. When you create a Service User you can:
* Add Permission Policies to the Service User to control what they can do when they gain access to your Organization.
* Generate Access Keys for the Service User, which you can use to perform service authentication with the m3ter platform. When you have authenticated the Service User, you can then can obtain a Bearer Token for use in API calls made to the platform by the Service User. For more details, see [Service Authentication](/guides/authenticating-with-the-platform/service-authentication).
This topic explains how to create Service Users for your Organization and generate access keys for them. How to assign Permission Policies to your Service Users and manage them is also explained:
* [Creating Service Users](/guides/organization-and-access-management/managing-users/creating-and-configuring-service-users#creating-service-users)
* [Assigning Permission Policies to Service Users](/guides/organization-and-access-management/managing-users/creating-and-configuring-service-users#adding-permission-policies-to-service-users)
* [Generating Access Keys for Service Users](/guides/organization-and-access-management/managing-users/creating-and-configuring-service-users#generating-access-keys-for-service-users)
* [Managing Service Users](/guides/organization-and-access-management/managing-users/creating-and-configuring-service-users#managing-service-users)
## Creating Service Users
**To create a Service User:**
1. Select **Settings>Access** **settings**. The **Access settings** page opens with the **Users** tab selected.
2. Select the **Service users** tab. Existing Service Users in your **Organization** are listed.
3. Select **Create service user**. The **Create** page opens.
4. Enter a **Name** for the new Service User.
5. If you want to generate an access key for the new Service User, leave the **Generate access key** switch enabled, which is the default setting.
* Note that you can create the new Service User without generating an access key - simply disable the switch - and you can edit and generate an access key later. See the [section below](/guides/organization-and-access-management/managing-users/creating-and-configuring-service-users#generating-access-keys-for-service-users).
6. If you want to assign Permission Policies to the new Service User, use the **Permission policies** drop-down list to select them - the list will contain both the *Managed* and any *Custom* Permission Policies that exist in your Organization.
* Note that you can create the new Service User without assigning any Permission Policies - simple leave the **Permission policies** drop-down empty - and you can edit and assign them later. See the [section below](/guides/organization-and-access-management/managing-users/creating-and-configuring-service-users#adding-permission-policies-to-service-users).
7. Select **Create service user**. The new Service User is created and a **Generate access key** modal appears, which shows:
* **Organization ID**
* **Access Key ID**
* **API secret**
as:
* **Environment variables**
* **JSON**
* **Individual values**
You can copy each of these to your clipboard, as required.
**Important!** When you generate an access key for a Service User, you need to keep a record of the **Api secret** before you close the popup, because this will only be shown once.
8. On the **Generate access key** popup, select **Close**. You are returned to the **Service user details** page for the new Service User:
In this example, when we created the new Service User we've:
* Assigned the **ReadOnly** **Managed** Permission Policy.
* Generated an **Access key**.
## Adding Permission Policies to Service Users
Two *Managed* Permission Policies are currently available to assign to your Service Users:
* **Administrator**. Read and write permissions. Can submit API calls.
* **ReadOnly**. Read permissions only. Cannot submit API calls.
You *cannot edit* Managed Permission Policies.
You can also assign any *Custom* Permission Policies you've created to Service Users.
**Warning: Working with Permission Policies?** Before creating Custom Permission Policies to control Users access to your Organization, we strongly recommend that you review the following topic in this section on [Understanding, Creating, and Managing Permission Policies](/guides/organization-and-access-management/creating-and-managing-permissions).
**To add and manage Permission Policies for a Service User:**
1. On the **Settings>Access settings>Service users** tab, select the **Name** text of the Service User. The details page for the Service User opens. Any Permission Policies assigned to the Service User are listed in the **Permission policies** panel.
2. Select **Add permission policies**. A **Select permission policies** dialog appears.
3. Select the Permission Policies you want to assign to the Service User and click **Confirm**. You are returned to the details page where the selected Permission Policy is now listed in the **Permission policies** panel.
4. If you want add another Permission Policy to the Service User, repeat steps 2 and 3.
**Important!** You must add the **Administrator** Permission Policy to a Service User to allow the user to make API calls to the platform.
5. If you want to delete a Permission Policy from a Service User, select the **Delete** button. You are asked to confirm the delete action.
## Generating Access Keys for Service Users
You can generate access keys for Service Users at any time.
**To add and manage Access Keys for Service Users:**
1. On the **Settings>Access settings>Service users** tab, select the **Name** text of the Service User. The details page for the Service User opens. Any access keys generated for the Service User are listed in the **Access keys** panel.
2. Select **Generate access key**. A **Generate access key** popup appears, which shows:
* **Organization ID**
* **Access key ID**
* **API secret**
as:
* **Environment variables**
* **JSON**
* **Individual values**
You can copy each of these to your clipboard, as required.
**Important!** When you generate an access key for a Service User, you need to keep a record of the **Api secret** before you close the popup, because this will only be shown once.
3. On the **Generate access key** popup, select **Close**. You are returned to the details page where the access key is listed as **ACTIVE** on the **Access keys** panel.
You can now use the **Access key id** and **Api secret** to authenticate the Service User to m3ter using the Basic Authentication method and obtain a Bearer Token for making subsequent API calls. See [Service Authentication](/guides/authenticating-with-the-platform/service-authentication).
4. If you want to generate additional access keys, you can repeat steps 2 to 3. If you generate additional keys, you should take care to mark the old ones as **Inactive** - those for which you cannot remember or find the **Api secret** or those no longer required due to rotation.
**Tip: Rotating Access Keys?** Note that you can only create up to two Access Keys at a time - if you want to maintain continual rotation of your Service User Access Keys, after creating two you must first inactivate and remove one to create a new one.
## Managing Service Users
**To manage Service Users:**
1. Select **Settings>Access** **settings**. The **Access settings** page opens with the **Users** tab selected.
2. Select the **Service users** tab. The page adjusts and list the Service Users in your Organization.
3. If you want to edit a Service User, select the **Edit** icon:
The **Edit** page opens.
4. Make your editing changes and select **Update service user**.
5. If you want to delete a Service User, select the **Delete** icon:
A confirmation dialog appears.
6. Select **Yes** to continue and delete the Service User.