My setup is Tridion Sites 9.6, Access Management installed and enabled, Add-On service installed and active.

My use case is to upload an add-on package (Zip archive) to Add-On service using access tokens issued by Access Management.

I am able to do so using my own account (or any user account, for that matter) that has "Services and roles" "Administrator" for "Add-ons API" in Access Management.

This is not desirable, since we'd rather use a service account. Here comes the problem -- Access Management comes with some predefined service accounts (e.g. "Add-ons API"), but unfortunately, it has only "Services and roles" "Service" and as such it seems to only be read-only. So I'm able to connect with it (ClientId + secret), Add-On service accepts the connection and I can 'read' stuff. But the moment I issue an upload (POST) request, it fails with error "Forbidden". Note that the same code works fine with my own user account with role "Administrator".

So, how can one change/create a service account in Access Manager and specify the roles for it? How are those initial predefined accounts specified? Where do they get created? Where is their definition?

1 Answer 1


I have found that the service accounts included in Access Management here are not intended for this use case. These are the accounts that the different Tridion services use to communicate with each other, aka internal service calls. Access Management does not provide anything it will call a Service Account for client services like you are describing.

So you have to implement this by convention instead. You have to add your service account as a user in Access Management so it can get the token, and then give it the appropriate permissions or roles either via your SSO claims and/or by granting the API access to the user account directly in Access Management.

  • 1
    Indeed, in Tridion Sites 9.5/9.6, it is not possible to define your own Service Accounts, but you can add Client Credentials to a User. So you can use Users as if they are Service Accounts. In Tridion Sites 10.0, this has been changed: you can now define your own Service Accounts and use of Client Credentials on Users is deprecated. Jan 23 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.