Service accounts give AgentOS proper machine identities in the form of agno_pat_... personal access tokens. Run uvx agno connect and it mints a per-client token, writes the MCP config into your coding agent, and verifies the handshake, so you skip hand-editing JSON. The tokens are built for real security: stored as SHA-256 hashes, scoped per user, expiring after 90 days by default, revocable on demand, and enforced across every deployment mode, including /mcp and WebSockets.
See docs.