---
title: "How do I set up a service user account?"
slug: "how-do-i-set-up-a-service-user-account"
updated: 2025-12-18T15:29:02Z
published: 2025-12-18T15:29:02Z
canonical: "support.lusid.com/how-do-i-set-up-a-service-user-account"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I set up a service user account?

You can set up a new account for a [service user](/v1/docs/what-are-a-personal-user-and-a-service-user). Note evey user automatically gets a [unique ID](/v1/docs/what-is-a-user-id-and-how-do-i-discover-one).

> [!NOTE]
> **Note:** If you are the LUSID domain owner, you are automatically assigned the built-in `lusid-administrator` role, which has all the permissions necessary to perform the operations in this article.

We recommend setting up one service user account for each distinct application or service that needs to call the LUSID API. This is because the service user owning that application or service should only have [roles](/v1/docs/what-is-a-role) granting permissions to perform the operations for which it is designed, and no more.

## Using the LUSID web app

1. Sign in to the [LUSID web app](https://www.lusid.com/app) using the credentials of a LUSID administrator.
2. From the left-hand menu, select **Identity and access > Users**: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image-1431RTPM.png)
3. On the **Users** dashboard, click the **Create user** button.
4. In the **Create user** dialog:
  1. Specify an **Account type** of **Service**.
  2. Enter a **Login** user name (this must look like an email address but no email will be sent to it) .
  3. Enter a valid **Email address** for an account owner (this person must be available to complete the sign up process; it could be your email address, for example).
  4. Optionally add a **Second email address**, which may be useful for account recovery.
  5. Optionally enable **User is temporary** and specify a **User Expiry** date (otherwise the account is valid forever). [More information](/v1/docs/what-are-a-personal-user-and-a-service-user#user-status).
  6. Optionally **Add roles** (permissions) for the user, though you can also do this later: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image-0FGDTX9Q.png)
5. Click the **Save** button to send an email to the account owner to [complete the sign up process](/v1/docs/how-do-i-set-up-a-service-user-account#completing-the-sign-up-process).

## Using the Identity API

1. [Obtain an API access token](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta).
2. Call the [CreateUser](https://www.lusid.com/docs/api/identity/endpoints/users/CreateUser) API, passing in your API access token and specifying account characteristics. Note `emailAddress` must be a valid email address that is unique within your LUSID domain; login must look like an email address but no email will be sent to it. If you omit `userExpiry`, a user is valid forever. For example:

```json
curl -X POST "https://<your-domain>.lusid.com/identity/api/users"
   -H "Authorization: Bearer <your-access-token>"
   -H "Content-Type: application/json"
   -d '{
  "emailAddress": "john.doe@acme.com",
  "firstName":"instrument-upload-service@acme.com",
  "lastName":"--",
  "login":"instrument-upload-service@acme.com",
  "roles":[],
  "type":"Service",
  "userExpiry": "2027-01-01T12:00:00Z"
}'
```

The response contains an automatically-generated id that uniquely identifies the user:

```json
{
   "id": "00ubs35svrtj69tei2p7",
   "emailAddress": "john.doe@acme.com",
   "login": "instrument-upload-service@acme.com",
   "firstName": "instrument-upload-service@acme.com",
   "lastName": "--",
   "roles": [],
   "type": "Service",
   "status": "PROVISIONED",
   "external": false,
   "userExpiry": "2027-01-01T12:00:00.0000000+00:00",
   ...
}
```

An email is automatically sent to `emailAddress` to complete the sign up process.

## Completing the sign up process

The account owner must complete the sign up process by clicking the link in the email. If you (or they) don’t receive the email, you can [send it again](/v1/docs/how-do-i-change-passwords-or-mfa-settings-or-revoke-access#changing-the-credentials-of-other-users-via-the-lusid-web-app).

This person must then specify a password that conforms to [LUSID’s password policy](/v1/docs/what-are-lusids-password-policies) for service users. Note there is no multi-factor authentication (MFA).