Machine Identity
A machine identity is the credential that lets a device, server, application or workload prove who it is to another system without a person signing in: most often an X.509 certificate, and also SSH keys, API keys, cloud workload credentials and SPIFFE SVIDs. Machine identities are the cryptographic subset of non-human identities.
| Credential | Issued by | Typical lifetime | Managed with |
|---|---|---|---|
| Public TLS certificate | Public certificate authority | At most 200 days since March 15, 2026, 47 days from 2029 | ACME, CLM |
| Internal mTLS or device certificate | Private CA | Policy-defined, often hours to a year | CLM, service mesh |
| SPIFFE SVID | SPIRE or a mesh CA | Short-lived by design | Workload identity platform |
| Cloud workload credential | AWS, Azure or Google Cloud | Minutes to hours | Workload identity federation |
| SSH key, API key | Whoever generated it | Often never expires | Secrets management |
"Machine identity" and "non-human identity" are often used interchangeably, but the useful distinction is this: NHI is the whole population of non-person identities, including service accounts and AI agents, while machine identity management focuses on issuing, rotating and revoking the credentials those identities present. The public TLS lifetime cuts under CA/Browser Forum Ballot SC-081v3 are the main reason the market has grown: a certificate that renews every 47 days cannot be managed by spreadsheet.
It matters because a stolen machine credential is a stolen identity with no MFA in front of it. The goal is credentials that are short-lived, attested by the platform and owned by a named team, rather than long-lived keys that someone pasted into a config file.
See also: what is machine identity, machine identity management guide, top machine identity management platforms, best machine identity for enterprises, machine identity vendors
Related on Start with Identity
- GlossaryWIMSE (Workload Identity in Multi-System Environments)
WIMSE (Workload Identity in Multi-System Environments) is an [IETF working group](https://datatracker.ietf.org/wg/wimse/about/) and the family of specifications
- GlossaryAPI Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be v
- GlossaryCredential Brokering
Credential brokering is the pattern in which an intermediary fetches a credential from a vault or credential store at the moment of access and hands it to an al
- RankingBest Machine Identity for Startups: Top 5 Secrets & Workload Tools
The best machine identity tools for startups in 2026: Infisical, Doppler, HashiCorp Vault, Akeyless, and SPIFFE/SPIRE. Ranked for developer experience, pricing,
- ArticleIdentity for Manufacturing: OT Access, Machine Identity, and NIS2
Manufacturing identity spans the plant floor and the supply chain: privileged access to operational technology, machine identity for connected equipment, and go
- BlogNIST opens an implementation hub for SP 800-63-4, with machine-readable conformance criteria
NIST launched a resource site for the Digital Identity Guidelines, Revision 4, with FAQs, version 0.1 conformance criteria in Excel, PDF and OSCAL, a subscriber