Service Account Token.

A JWT credential mounted into a Kubernetes pod that authenticates the workload to the API server and to other services trusting the cluster's identity provider. It belongs to the Cloud Security category of cybersecurity.

A JWT credential mounted into a Kubernetes pod that authenticates the workload to the API server and to other services trusting the cluster's identity provider.

A Kubernetes ServiceAccount represents a non-human identity used by pods. The associated token is a signed JSON Web Token automatically projected into the pod at /var/run/secrets/kubernetes.io/serviceaccount/token (TokenRequest API in modern versions) and used to call the Kubernetes API server. The token includes audience, expiration, namespace, and pod claims. Because tokens grant access via RBAC, leakage is dangerous: an attacker with a stolen token can list, modify, or destroy cluster resources scoped by the role binding. Best practice is to use bound, audience-scoped, short-lived tokens, disable automatic mounting where not required, restrict role bindings to least privilege, and federate workload identity to cloud IAM (OIDC, Workload Identity, IRSA).

Defences for Service Account Token typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: ServiceAccount token, Projected SA token.