# `Lightning.ServiceAccount`
[🔗](https://github.com/OpenFn/lightning/blob/main/lib/lightning/service_account.ex#L1)

An identity that is not a person and proves who it is with an RSA key pair.

Its `id` is the RFC 7638 thumbprint of its public key, so a new key is a new
service account. Its `uuid`, for places that need one such as an audit
event's actor, is a UUIDv5 of the thumbprint's RFC 9278 URI in the RFC 4122
URL namespace, which any stock `uuid5` implementation reproduces.

`grants` are the scopes of the access token the request came in with. The
account registered at boot holds none, so it is refused every action that
needs a grant.

# `t`

```elixir
@type t() :: %Lightning.ServiceAccount{
  grants: MapSet.t(String.t()),
  id: String.t(),
  public_key: JOSE.JWK.t(),
  uuid: Ecto.UUID.t()
}
```

# `from_pem`

```elixir
@spec from_pem(String.t()) ::
  {:ok, t()}
  | {:error, :private_key | :not_rsa | {:too_small, pos_integer()} | :not_a_key}
```

Reads the service account from its public key's PEM text.

Refuses anything but an RSA public key of at least 2048 bits:
`{:too_small, bits}` for a shorter RSA key, `:private_key` for an RSA private
key, `:not_rsa` for any other kind of key, and `:not_a_key` for text JOSE
can't read as a key.

---

*Consult [api-reference.md](api-reference.md) for complete listing*