Introducing M2M Authentication with Organization-Level Service Accounts

We’re excited to launch Machine-to-Machine (M2M) Authentication for your APIs-- starting with Organization-Level Service Accounts. If your B2B app shares APIs to customers or their internal systems, this feature lets you securely authenticate non-human clients like APIs, CLI scripts, back-end services, or AI agents with full org-level control. This is a completely programatic workflow.

What are Organization-Level Service Accounts?

These Service Accounts let your app register and authenticate clients that operate on behalf of a customer organization.  They are ideal for non-human actors (like APIs, CLI scripts) that need secure, scoped access to organization-level data and resources.

Unlike user-based credentials, org-level service accounts :

• Operate independently of human users
• Persist through team changes and employees turnover
• Enforce strict  access to a specific organization’s scope boundaries

How does the Authentication Work?

1. Register a client for a customer organization via Scalekit's API
2. Specify desired scopes and token expiry
3. Receive a Client ID and Client Secret from Scalekit, which you can use in the Client (Script or API or AI agent)
4. The client uses these to call /oauth/token and receives a JWT access token containing encoded permissions and expiry
5. Your app can verify this token, enabling secure access

Key Features

• Fully programmatic: Create and mange service accounts without user dependancies
• Scoped access: Restrict each client's token to specific permissions at organization-level
• Token-based Authentication: Claims and scopes are embedded directly in JWT access tokens for performance and security
• Multiple Clients per Org: Support distinct clients  per organization with tailored scopes
• Configurable Token Expiry: Configure token lifetimes per use case
• Secret Rotation: Rotate tokens programmatically to minimize risk
• Efficient Token Validation: Validate tokens locally via SDKs or your own JWT libraries

Common Use Cases

• API Clients: Enable your customer-owned  applications  query your APIs  securely  (e.g., analytics dashboards, ticket history, billing history etc.)
• AI Agents: Enable your customers' AI workflows connect to your API with scoped access to relevant organization-specific resources (e.g., AI agents that fetch invoices, Chatbots that need support history, Data summarization tools)

Get Started

Refer to our Developer Documentation for a step-by-step guide on implementing M2M Authentication with Org-Level Service Accounts.

‍