# What is a Non-Human Identity?
> A non-human identity is any identity used by software rather than a person — service accounts, API keys, workload identities, certificates, tokens, and agents that authenticate to systems.
- Canonical URL: https://yellowcube.eu/glossary/non-human-identity/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu
## Content
Applications, scripts, pipelines, containers, and cloud workloads all need credentials to call APIs, read data, and deploy changes. Machine identities commonly outnumber human ones in enterprise environments, and they typically carry high privilege, weak rotation, sparse ownership records, and no offboarding when the service is retired.
### Key points
- **Inventory:** Enumerate service accounts, keys, certificates, and tokens; assign each an owner, purpose, scope, and expiry.
- **Platform-native identity:** Cloud managed identities and workload-identity federation remove stored secrets where possible; where secrets must exist, vault and rotate them.
- **Important limitation:** NHI security is a lifecycle problem, not a vault problem. Storing a key safely does not fix excessive permissions, unknown usage, missing owners, or credentials that never expire.
### Related terms
[Service account]() · [API key]() · [Secrets management]() · [Cloud infrastructure entitlement management (CIEM)]() · [Identity and access management (IAM)]()
### Sources
[OWASP, Non-Human Identities Top 10](https://owasp.org/www-project-non-human-identities-top-10/) · [NIST SP 800-207, Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)
## Attribution and scope
This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.