[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Step-by-step guides](../index.md) > Service accounts > Getting an ID token for a service account

# Getting a service account ID token

{% note info %}

Creating ID tokens for service accounts may be prohibited by [access policies](../../concepts/access-control/access-policies.md) at the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder), [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud), or [organization](../../../organization/concepts/organization.md) level.

{% endnote %}

To use Yandex Identity and Access Management for authentication in an external system with [OIDC](https://openid.net/specs/openid-connect-core-1_0.html) authentication support, you need to get an [ID token](../../concepts/authorization/id-token.md). You can only get an ID token for a [service account](../../concepts/users/service-accounts.md).

To get an ID token:

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the description of the command for creating an ID token:

      ```bash
      yc iam create-id-token --help
      ```
  1. Get the ID of the service account to use for authentication in the external system:

      ```bash
      yc iam service-account list
      ```

      Result:

      ```
      +----------------------+--------------+--------+---------------------+-----------------------+
      |          ID          |     NAME     | LABELS |     CREATED AT      | LAST AUTHENTICATED AT |
      +----------------------+--------------+--------+---------------------+-----------------------+
      | ajeg2b2et02f******** | my-robot     |        | 2024-09-08 18:59:45 | 2025-02-18 10:10:00   |
      | ajegtlf2q28a******** | account-name |        | 2023-06-27 16:18:18 | 2025-02-18 10:20:00   |
      +----------------------+--------------+--------+---------------------+-----------------------+
      ```
  1. Get an ID token for the service account:

      ```
      yc iam create-id-token \
        --subject-id <service_account_ID> \
        --audience <resource>
      ```

      Where:

      * `--subject-id`: [ID](get-id.md) of the service account to create an ID token for.
      * `--audience`: Target resource for the token. This is an optional setting. If left unspecified, this value defaults to the service account ID specified in the `subject-id` parameter.

      In response, the command will output the [body](../../concepts/authorization/id-token.md#token-format) of the created service account ID token to the standard output stream (`STDOUT`).

{% endlist %}