Service accounts

Machine-to-machine identities. Issue them access keys for HMAC-signed API calls.