# Service principals

> Non-human tenant members backed by auth.users rows that can't sign in, with roles through memberships. Organization-owned workflow versions and service webhook endpoints run as the tenant's default principal.

- Category: Developer platform
- Module: `service-accounts`
- Modes: `managed`, `adopt`, `custom`
- Docs: https://bettersupabase.com/docs/blocks/service-accounts
- Page: https://bettersupabase.com/blocks/service-accounts

## Install

```bash
npx better-supabase add service-accounts
```

The command also installs `updated-at`, `memberships`, `permissions`.

## Configure

Add the block to `better-supabase.config.ts`:

```ts
import { defineConfig } from "better-supabase/config";

export default defineConfig({
  blocks: {
    // Required by service-accounts; add installs them too.
    "updated-at": {},
    memberships: {},
    permissions: {},
    // Modes: "managed", "adopt", "custom". The default is "managed".
    "service-accounts": { mode: "managed" },
  },
});
```

## Client

The block has no React entry yet. Its server-side TypeScript is in `better-supabase/blocks/service-accounts`.

## Events

- `service_principal.created`
- `service_principal.disabled`
- `service_principal.role_changed`

## Related blocks

Requires: [memberships](https://bettersupabase.com/blocks/memberships.md), [permissions](https://bettersupabase.com/blocks/permissions.md)

Works with: [audit](https://bettersupabase.com/blocks/audit.md)

## Recipes

- [Service principals table](https://bettersupabase.com/recipes/service-principals-table.md): Machine identities with their scopes, last use and a button to disable one.