Modal logo
IntroductionCustom container images Defining ImagesUsing existing container imagesFast pull from registryGPUs and other resources GPU accelerationUsing CUDA on ModalConfiguring CPU and memoryScaling out Scaling outInput concurrencyBatch processingJob queuesDynamic batching (beta)Multi-node clusters (beta)Deployment Apps, Functions, and entrypointsManaging deploymentsInvoking deployed functionsContinuous deploymentRunning untrusted code in FunctionsModal Sandboxes SandboxesRunning commandsNetworking and securityFile accessSnapshotsModal NotebooksSecrets and environment variables SecretsEnvironment variablesScheduling and cron jobsWeb endpoints Web endpointsStreaming endpointsWeb endpoint URLsRequest timeoutsProxy Auth TokensNetworking TunnelsProxies (beta)Cluster networkingData sharing and storage Passing local dataVolumesStoring model weightsCloud bucket mountsDictsQueuesDataset ingestionPerformance Cold start performanceMemory SnapshotsHigh-performance LLM inferenceGeographic latencyReliability and robustness Failures and retriesPreemptionTimeoutsGPU healthTroubleshootingSecurity and privacyIntegrations Using OIDC to authenticate with external servicesConnecting Modal to your Datadog accountConnecting Modal to your OpenTelemetry providerOkta SSOCustom SAML SSOSlack notifications (beta)Workspace & account settings WorkspacesEnvironmentsModal user account setupService usersRole-Based Access Control (RBAC)BillingOther topics Feature maturityJavaScript/Go SDKsModal 1.0 migration guideFile and project structureDeveloping and debuggingDeveloping Modal code with LLMsJupyter notebooksAsynchronous API usageGlobal variablesRegion selectionContainer lifecycle hooksParametrized functionsS3 Gateway endpointsGPU Metrics

Service Users (Beta)

Service users are programmatic accounts that allow automated systems to interact with Modal. They’re ideal for CI/CD pipelines, automated deployments, and other workflows that need to authenticate.

Create a Service User 

Service users are only available for shared workspaces. You will need workspace owner or manager privileges to create service users.

To create a service user:

  1. Go to your workspace tokens settings page
  2. Click New Service User
  3. Enter a name for your service user (must be lowercase alphanumeric, can contain hyphens or underscores)
  4. Click Create

After creation, you’ll see the MODAL_TOKEN_ID and MODAL_TOKEN_SECRET. This is the only time you can view the token secret for security reasons.

Use Service User Tokens 

Set the service user credentials as environment variables in your automated environment:

Once configured, you can use Modal’s CLI and Python SDK as usual:

Delete a Service User 

To remove a service user:

  1. Go to the tokens settings page
  2. Find the service user in the table
  3. Click Delete when you hover over the row

Permissions 

Service users have the same permissions as workspace members. They cannot do actions that are only permitted for a workspace owner or manager. To learn more about members, managers, and owners, see this workspace section.

Securing Service Users 

Because service user tokens are long-lived and used in automated environments, it’s important to limit their access to only what’s necessary:

  • Store tokens securely. Use a secrets manager or your CI/CD platform’s built-in secrets storage rather than hardcoding tokens in source code or configuration files.
  • Use restricted Environments. Assign service users the Contributor role only on the specific Environments they need access to, keeping production isolated from development and staging.