IT Glossary
A machine identity authenticates non-human entities like servers and services. Learn how they work, how they differ from NHIs, and why governance matters.
July 3, 2026
A machine identity is a digital credential used to authenticate and authorize non-human entities such as servers, applications, services, containers, and devices. Managed through certificates, keys, and tokens, machine identities let systems communicate securely with one another. As automation and cloud adoption grow, the number of machine identities rises fast, demanding the same governance as human identities.
Machine identities take several forms: a certificate, such as a TLS certificate for a server; an API key or token, used for service-to-service authentication; and a service account, which is an app's own login to a system.
A microservice authenticates to a database using a certificate that should rotate automatically. If it never expires and no one owns it, it becomes a long-lived risk. Machine identity is closely related to non-human identity: machine identity emphasizes the credential and the entity it represents, while NHI is the broader category of all non-person identities. Both need ownership, least privilege, rotation, and review at scale.
Machine identity emphasizes the credential and the machine it represents. Non-human identity is the broader category covering all non-person identities, including services, bots, and AI agents.
Because they authenticate access between systems, often with broad permissions and long-lived credentials. Without rotation, ownership, and review, they become security gaps.
Through certificates, API keys, and tokens, rather than passwords and MFA, which is why their lifecycle management differs from human accounts.
