feat(web): add service accounts for non-human API access

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added service accounts: non-human identities that own their own API keys for programmatic access, managed under Settings -> Service Accounts. [#1583](https://github.com/sourcebot-dev/sourcebot/pull/1583)
+
 ## [5.1.7] - 2026-08-13
 
 ### Added

packages/db/prisma/migrations/20260813182022_add_service_accounts/migration.sql

@@ -0,0 +1,10 @@
+-- CreateEnum
+CREATE TYPE "UserType" AS ENUM ('HUMAN', 'SERVICE');
+
+-- AlterTable
+ALTER TABLE "User" ADD COLUMN     "createdById" TEXT,
+ADD COLUMN     "description" TEXT,
+ADD COLUMN     "type" "UserType" NOT NULL DEFAULT 'HUMAN';
+
+-- AddForeignKey
+ALTER TABLE "User" ADD CONSTRAINT "User_createdById_fkey" FOREIGN KEY ("createdById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;

packages/db/prisma/schema.prisma

@@ -399,6 +399,16 @@ enum OrgRole {
   MEMBER
 }
 
+/// Discriminates a normal human account from a non-interactive service
+/// account. Service accounts never authenticate via session/OAuth — only
+/// via API key — and are excluded from seat counts and member-facing
+/// listings (see `humanMembershipWhere` and its call sites in
+/// `features/membership`).
+enum UserType {
+  HUMAN
+  SERVICE
+}
+
 enum McpServerClientInfoSource {
   DYNAMIC
   STATIC
@@ -569,6 +579,20 @@ model User {
   /// Last time the user performed an authenticated action.
   lastActiveAt DateTime?
 
+  /// Discriminates a human account from a service account. See `UserType`.
+  type UserType @default(HUMAN)
+
+  /// Free-text description shown in the Service Accounts settings UI. Unused
+  /// for HUMAN users.
+  description String?
+
+  /// The human member who created this service account, kept for
+  /// attribution/display only (never used in an auth check). Null for HUMAN
+  /// users, and for SERVICE users whose creator was later removed.
+  createdBy   User?  @relation("ServiceAccountCreatedBy", fields: [createdById], references: [id], onDelete: SetNull)
+  createdById String?
+
+  createdServiceAccounts User[] @relation("ServiceAccountCreatedBy")
 }
 
 enum AccountPermissionSyncJobStatus {

packages/web/src/__mocks__/prisma.ts

@@ -1,5 +1,5 @@
 import { SINGLE_TENANT_ORG_ID, SINGLE_TENANT_ORG_NAME } from '@/lib/constants';
-import { Account, ApiKey, OAuthRefreshToken, OAuthToken, Org, PrismaClient, User } from '@prisma/client';
+import { Account, ApiKey, OAuthRefreshToken, OAuthToken, Org, PrismaClient, User, UserType } from '@prisma/client';
 import { beforeEach, vi } from 'vitest';
 import { mockDeep, mockReset } from 'vitest-mock-extended';
 
@@ -46,6 +46,26 @@ export const MOCK_USER_WITH_ACCOUNTS: User & { accounts: Account[] } = {
     lastActiveAt: null,
     image: null,
     sessionVersion: 0,
+    type: UserType.HUMAN,
+    description: null,
+    createdById: null,
+    accounts: [],
+}
+
+export const MOCK_SERVICE_ACCOUNT_USER: User & { accounts: Account[] } = {
+    id: 'service-1',
+    name: 'Test Service Account',
+    email: 'svc+service-1@service.internal',
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    hashedPassword: null,
+    emailVerified: null,
+    lastActiveAt: new Date(),
+    image: null,
+    sessionVersion: 0,
+    type: UserType.SERVICE,
+    description: 'A test service account',
+    createdById: MOCK_USER_WITH_ACCOUNTS.id,
     accounts: [],
 }
 

packages/web/src/actions.ts

@@ -1,6 +1,7 @@
 'use server';
 
 import { createAudit } from "@/ee/features/audit/audit";
+import { auditActorForUser } from "@/ee/features/audit/utils";
 import { ErrorCode } from "@/lib/errorCodes";
 import { notFound, ServiceError } from "@/lib/serviceError";
 import { sew } from "@/middleware/sew";
@@ -54,10 +55,7 @@ export const createApiKey = async (name: string): Promise<{ key: string } | Serv
         if (existingApiKey) {
             await createAudit({
                 action: "api_key.creation_failed",
-                actor: {
-                    id: user.id,
-                    type: "user"
-                },
+                actor: auditActorForUser(user),
                 target: {
                     id: org.id.toString(),
                     type: "org"
@@ -87,10 +85,7 @@ export const createApiKey = async (name: string): Promise<{ key: string } | Serv
 
         await createAudit({
             action: "api_key.created",
-            actor: {
-                id: user.id,
-                type: "user"
-            },
+            actor: auditActorForUser(user),
             target: {
                 id: apiKey.hash,
                 type: "api_key"
@@ -115,10 +110,7 @@ export const deleteApiKey = async (name: string): Promise<{ success: boolean } |
         if (!apiKey) {
             await createAudit({
                 action: "api_key.deletion_failed",
-                actor: {
-                    id: user.id,
-                    type: "user"
-                },
+                actor: auditActorForUser(user),
                 target: {
                     id: org.id.toString(),
                     type: "org"
@@ -144,10 +136,7 @@ export const deleteApiKey = async (name: string): Promise<{ success: boolean } |
 
         await createAudit({
             action: "api_key.deleted",
-            actor: {
-                id: user.id,
-                type: "user"
-            },
+            actor: auditActorForUser(user),
             target: {
                 id: apiKey.hash,
                 type: "api_key"

packages/web/src/app/(app)/settings/layout.tsx

@@ -116,6 +116,12 @@ export const getSidebarNavGroups = async () =>
                         href: `/settings/members`,
                         icon: "users" as const,
                     },
+                    {
+                        title: "Service Accounts",
+                        href: `/settings/serviceAccounts`,
+                        hrefRegex: `/settings/serviceAccounts(/.*)?$`,
+                        icon: "server" as const,
+                    },
                     {
                         title: "Connections",
                         href: `/settings/connections`,

packages/web/src/app/(app)/settings/serviceAccounts/[id]/page.tsx

@@ -0,0 +1,53 @@
+import { authenticatedPage } from "@/middleware/authenticatedPage";
+import { getServiceAccountApiKeysAction, listServiceAccounts } from "@/features/serviceAccounts/actions";
+import { isServiceError } from "@/lib/utils";
+import { ServiceErrorException } from "@/lib/serviceError";
+import { OrgRole } from "@sourcebot/db";
+import { notFound } from "next/navigation";
+import Link from "next/link";
+import { ArrowLeft } from "lucide-react";
+import { ServiceAccountApiKeysPage } from "./serviceAccountApiKeysPage";
+
+export default authenticatedPage<{ params: Promise<{ id: string }> }>(async (_auth, { params }) => {
+    const { id } = await params;
+
+    const [serviceAccounts, apiKeys] = await Promise.all([
+        listServiceAccounts(),
+        getServiceAccountApiKeysAction(id),
+    ]);
+
+    if (isServiceError(serviceAccounts)) {
+        throw new ServiceErrorException(serviceAccounts);
+    }
+
+    const serviceAccount = serviceAccounts.find((sa) => sa.id === id);
+    if (!serviceAccount) {
+        return notFound();
+    }
+
+    if (isServiceError(apiKeys)) {
+        throw new ServiceErrorException(apiKeys);
+    }
+
+    return (
+        <div className="flex flex-1 min-h-0 flex-col gap-6">
+            <div>
+                <Link
+                    href="/settings/serviceAccounts"
+                    className="inline-flex items-center gap-1 text-sm text-muted-foreground hover:text-foreground mb-2"
+                >
+                    <ArrowLeft className="h-3.5 w-3.5" />
+                    Service Accounts
+                </Link>
+                <h3 className="text-lg font-medium">{serviceAccount.name}</h3>
+                <p className="text-sm text-muted-foreground">
+                    Create and manage API keys for this service account.
+                </p>
+            </div>
+            <ServiceAccountApiKeysPage serviceAccountId={id} apiKeys={apiKeys} />
+        </div>
+    );
+}, {
+    minRole: OrgRole.OWNER,
+    redirectTo: '/settings',
+});