# machine-identity

Source: https://startwithidentity.com/glossary/machine-identity/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

A machine identity is the credential that lets a device, server, application or workload prove who it is to another system without a person signing in: most often an [X.509](https://startwithidentity.com/glossary/x509/) certificate, and also SSH keys, API keys, cloud workload credentials and [SPIFFE](https://startwithidentity.com/glossary/spiffe/) SVIDs. Machine identities are the cryptographic subset of [non-human identities](https://startwithidentity.com/glossary/nhi/).

| Credential | Issued by | Typical lifetime | Managed with |
|---|---|---|---|
| Public TLS certificate | Public [certificate authority](https://startwithidentity.com/glossary/certificate-authority/) | At most 200 days since March 15, 2026, 47 days from 2029 | [ACME](https://startwithidentity.com/glossary/acme/), [CLM](https://startwithidentity.com/glossary/certificate-lifecycle/) |
| Internal mTLS or device certificate | Private CA | Policy-defined, often hours to a year | CLM, service mesh |
| SPIFFE SVID | SPIRE or a mesh CA | Short-lived by design | [Workload identity](https://startwithidentity.com/glossary/workload-identity/) platform |
| Cloud workload credential | AWS, Azure or Google Cloud | Minutes to hours | [Workload identity federation](https://startwithidentity.com/glossary/workload-identity-federation/) |
| SSH key, API key | Whoever generated it | Often never expires | [Secrets management](https://startwithidentity.com/glossary/secrets-management/) |

"Machine identity" and "non-human identity" are often used interchangeably, but the useful distinction is this: NHI is the whole population of non-person identities, including [service accounts](https://startwithidentity.com/glossary/service-account/) and AI agents, while machine identity management focuses on issuing, rotating and revoking the credentials those identities present. The public TLS lifetime cuts under CA/Browser Forum [Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) are the main reason the market has grown: a certificate that renews every 47 days cannot be managed by spreadsheet.

It matters because a stolen machine credential is a stolen identity with no MFA in front of it. The goal is credentials that are short-lived, attested by the platform and owned by a named team, rather than long-lived keys that someone pasted into a config file.

See also: [what is machine identity](https://startwithidentity.com/guides/fundamentals/what-is-machine-identity/), [machine identity management guide](https://startwithidentity.com/guides/machine-identity/machine-identity-management-guide/), [top machine identity management platforms](https://startwithidentity.com/articles/top-5-machine-identity-management-platforms/), [best machine identity for enterprises](https://startwithidentity.com/rankings/best-machine-identity-for-enterprises/), [machine identity vendors](https://startwithidentity.com/vendors/machine-identity/)