Context: Official docs (Service accounts): documents that creating a service account also creates a non-expiring API token, shown once at creation and never again (the token field is empty in list results). Service accounts cannot use the UI, only the APIs. Two types matter: unrestricted accounts for Chronoctl or Terraform, and restricted write-only accounts for the Collector or ingestion. You must be on a

Match the account type to the job. Ingestion or the Collector: create a restricted write-only service account, which follows least privilege. Chronoctl or Terraform: create an unrestricted one. Remember the token is non-expiring, so own the rotation story yourself, and copy the token at creation time because the API will not show it again. If creation fails with permissions errors, check that your own account is on a team with the SysAdmin role. Keep Terraform state with these tokens in a locked-down backend, since the token lives in state. And for label restrictions, remember the two-pair cap and that they are case sensitive.