Credentials - MixShift admin

How service credentials work what they are, why, and what to do with one

What: a service credential is a machine key (a client_id + secret pair) for things that run without a person present: scheduled Cowork tasks, cloud automations, CI jobs. Humans signing in interactively don't need one; their browser sign-in handles it.

Why: browser sign-ins need someone to click a link, and their tokens rotate. A schedule that wakes up at 9am with nobody at the keyboard can't do either. The service credential is static, so it survives restarts, fresh sandboxes, and read-only secret stores, and it mints short-lived (1 hour) access tokens on demand. Tokens are read-only unless you grant Amazon Ads write access when creating the credential.

How to set one up:

Click Create service credential below and name it after the automation (e.g. nightly-foep-watch). You'll get the client_id and a secret, shown exactly once.
On the machine or workspace where the automation runs, save the secret into a file (use an editor or secret manager, not a shell command that would land in history).
Run the mixshift auth service-setup command we'll show you after creation. It verifies by minting a real token, then your automation authenticates itself from then on.

Afterwards: activity shows up attributed to the credential's svc: label. You can revoke instantly or rotate with zero downtime from this page, any time. Full guide: service credentials documentation.

Service credentials

Machine keys for scheduled tasks, automations, and CI. Static secrets used with the OAuth client_credentials grant; revoking kills new token mints immediately.

Label	Client ID	Scopes	Created	Last used	Status

Also grant Amazon Ads write access (ads:write) - lets this automation apply audited Ads changes: bids, budgets, states, negatives, campaign creation. Writes still default to a dry-run preview and every committed change is audit-logged. Leave unchecked for read-only (the default and the right choice for most automations). Applies to both create options: the setup code and the raw secret.

Creates a one-time setup code (valid 10 minutes): paste it to Claude in the workspace where the automation runs, and the credential is issued directly into that machine - no secret to handle. Need the raw secret instead (CI, secret managers)?

Setup code created. Paste it to Claude within 10 minutes.

What to do

Go to the Claude (Cowork / Claude Code) workspace where the automation will run.
Say: "set up a service credential" and paste the code when asked - or just paste the code with that ask. Claude runs and the credential is issued straight into that machine. The code is single-use and expires in 10 minutes; nobody ever sees the secret.
The credential appears in the list above once Claude exchanges the code.

Credential created. Copy the secret now - it is shown exactly once.

Next steps (3 minutes)

On the machine or workspace where the automation runs, save the secret into a file named mixshift-secret.txt. Use an editor or your secret manager; avoid shell commands that would put the secret in history.
In that workspace, run this command (it verifies by minting a real token):
Delete mixshift-secret.txt. Done - the automation now authenticates itself. Access is limited to the scopes shown in the list above (read-only unless you granted Ads write), and you can revoke or rotate here any time.

Detailed guide: service credentials documentation

Active sessions

People signed in interactively - plugin sign-ins and partner app grants. Machine keys live on the Service credentials tab. Revoking ends that session's ability to refresh; its current access token ages out within hours.