Ansvar AI docs
    ansvar.eu →

    Service credentials

    A service credential is an OAuth2 client_credentials client that your organization owns. A headless client — an n8n workflow, a CI job, a server-side script — exchanges its client ID and secret for a short-lived access token and calls the gateway with that token. No browser, no interactive login, no static API key.

    Reach for one when the client cannot complete an interactive OAuth login — it runs on a server with no browser — but can perform the token exchange itself: n8n's OAuth2 credential, most server SDKs, a CI script with a few lines of shell. If your client can launch a local command instead, the mcp-remote bridge is simpler — see Clients without OAuth.

    Who can create one

    • Creating and rotating require an organization admin on a Team or Company plan.
    • Listing and revoking stay available to an org admin on any plan. That is deliberate: an organization that downgrades must still be able to kill a credential that is live.
    • The credential belongs to the organization, not to the admin who created it — any of the organization's admins can see it and revoke it, and can rotate it while the organization is on Team or Company.
    • It takes a seat, counted together with people. The account page reads N of M seats used (people and service credentials). Seats and roles are covered in Manage your organization.

    Create one

    1. Open your account area → Service credentials and choose Create credential.
    2. Name it after the system that will use it — n8n production, nightly CI. The name is how you will know what breaks when you revoke it.
    3. Copy the client ID and the client secret into the secret store that client already uses.

    Connect with it

    Exchange the credential for an access token at auth.ansvar.eu, then send that token to the gateway as a bearer token:

    # 1. Exchange the credential for an access token
TOKEN=$(curl -s -X POST https://auth.ansvar.eu/realms/ansvar/protocol/openid-connect/token \
  -d grant_type=client_credentials \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET | jq -r .access_token)

# 2. Call the MCP endpoint with that token
curl -s -X POST https://gateway.ansvar.eu/mcp \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

    Access tokens last 15 minutes. The credential itself is long-lived, so the client should exchange the secret for a fresh token whenever the current one is close to expiry, and never write an access token to disk or into a saved configuration. Clients that speak OAuth2 client credentials natively — n8n's HTTP Request credential, most server SDKs — handle that refresh once you give them the token URL, the client ID and the secret.

    What it can and cannot do

    A service credential is read-only, and the gateway enforces that on both sides of the call: write tools are hidden from tools/list and refused at tools/call even if the client asks for one by name.

    • Works — search across the corpora, provision lookup, citation validation.
    • Refused — running workflows, uploading documents and generating reports. Those need a signed-in user seat.

    Rotate and revoke

    Rotate issues a new secret and keeps the same client ID. The old secret stops working immediately, so update the client in the same change window. Rotate on a schedule you set, and straight away if a secret may have been exposed.

    Revoke refuses new tokens immediately and frees the seat. Access tokens already issued keep working until they expire — up to 15 minutes. Plan for that window: revocation is not a kill switch for a request already in flight.

    A row marked needs attention means the credential does not work — the client behind it cannot get a token. Revoke it and create a new one; there is nothing to repair in place.

    Troubleshooting

    • 401 right after a rotation — the client is still sending the old secret. The old one dies the moment the new one is issued; there is no overlap period.
    • 401 on a token that worked minutes ago — the access token expired. Exchange the secret for a fresh one instead of storing the token.
    • 404 at the endpoint — the MCP endpoint is https://gateway.ansvar.eu/mcp, not the bare host.
    • Create refused, "all your seats are in use" — a credential takes a seat like a member does. Raise the seat count under Manage subscription, or revoke a credential you no longer need.
    • Create or rotate refused on your plan — minting is Team and Company only. Listing and revoking still work, so an existing credential can always be shut off.
    • A tool you expected is missing from tools/list — write tools are hidden from service credentials by design. Run those from a signed-in user seat.