[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for YTsaurus](../index.md) > Concepts > Authentication

# Authentication in YTsaurus

You can access Managed Service for YTsaurus resources:
* [through the YTsaurus web interface](#users) (for users).
* [with an IAM token or API key](#service-accounts) (for service accounts).

Yandex Identity and Access Management manages access to Managed Service for YTsaurus resources. For more information, see [Access management](../security/index.md).

## User authentication in YTsaurus {#users}

To access the YTsaurus web interface, a user needs the [managed-ytsaurus.user](../security/index.md#managed-ytsaurus-user) role or higher for the Managed Service for YTsaurus cluster folder.

Upon the first successful authentication, the system automatically creates a new YTsaurus user with a username matching the user ID in Yandex Cloud. You cannot edit the YTsaurus username. YTsaurus does not support creating new users directly.

### YTsaurus user groups {#user-groups}

YTsaurus supports two user groups: `users` and `managers`. 

Upon first logging into the web interface, all users are automatically added to the `users` group.

The `managers` group automatically includes users from the `users` group who have the `managed-ytsaurus.editor` role or higher. Updating the group's user list may take up to 15 minutes.

YTsaurus does not support editing user groups directly.

## Service account authentication in Managed Service for YTsaurus {#service-accounts}

To access YTsaurus, a service account needs the [managed-ytsaurus.user](../security/index.md#managed-ytsaurus-user) role or higher for the Managed Service for YTsaurus cluster folder. 

[Service accounts](../../iam/concepts/users/service-accounts.md) can access YTsaurus by using:
* [IAM token](../../iam/concepts/authorization/iam-token.md): For short-term operations; the IAM token lifetime is 12 hours.
* [API key](../../iam/concepts/authorization/api-key.md): For long-running operations when you cannot get a new IAM token automatically.

Upon the first successful authentication of a service account, the system automatically creates a new YTsaurus user with a username matching the service account ID. You cannot edit the YTsaurus username.

### How to use API keys in Managed Service for YTsaurus {#api-key}

[Provide](../../iam/concepts/authorization/iam-token.md#use) API keys instead of IAM tokens.

When [creating an API key](../../iam/operations/authentication/manage-api-keys.md#create-api-key), specify `yc.managed-ytsaurus.cluster.use` as its [scope](../../iam/concepts/authorization/api-key.md#scoped-api-keys).

Here is an example of the command for creating an API key to access YTsaurus:

```bash
yc iam api-key create \
   --service-account-name <service_account_name> \
   --scopes yc.managed-ytsaurus.cluster.use \
   --expires-at <date_and_time> \
   > api_key.yaml
```