Use service accounts

Service accounts are programmatic identities that let scripts, orchestrators, CI/CD pipelines and clusters you run authenticate to Polars Nanook without a browser login. A service account is a client ID and client secret that belong to one workspace. The Developer plan allows one service account (see Plans and billing).

Create a service account

Open the workspace settings and click Add token in the Workspace service accounts section. Provide a name and description, click Create, and copy the Client ID and Client secret. You can also create it from the command line:

nanook service-account create --workspace-name "My workspace" --name "<SERVICE_ACCOUNT_NAME>"

Set up your environment

To authenticate with a service account, set the following environment variables to the credentials provided when the service account was created:

export NANOOK_CLIENT_ID="<CLIENT_ID>"
export NANOOK_CLIENT_SECRET="<CLIENT_SECRET>"

Once they are set, pn.authenticate() and any remote query pick them up automatically, so no manual login is needed.

When environment variables cannot be set, for example when the secret comes from a secret manager at runtime, pass the credentials explicitly:

import polars_nanook as pn

pn.authenticate(client_id="<CLIENT_ID>", client_secret="<CLIENT_SECRET>")

A cluster you run registers with the Polars control plane through a service account, as described in Install with the Helm chart and Install on bare-metal.

Revoke or delete a service account

When a service account is no longer needed, delete it to revoke its access: click Delete token (the trash icon) next to it in the Workspace service accounts section of the workspace settings, and confirm.

Deleting a service account cannot be undone. Any processes or applications relying on it lose access immediately. A cluster already registered with its credentials stays authenticated with its own cluster token until you stop or uninstall it.