What Is a Non-Human Identity (NHI)?

Quick answer
A non-human identity (NHI) is a credential used by software — service accounts, API keys, tokens, and certificates — rather than by a person.
In most modern environments, NHIs vastly outnumber human users, and they often hold the most privileged access.
NHIs are a top security risk because they’re numerous, long-lived, and rarely reviewed or rotated.

What is a non-human identity?

A non-human identity is any digital identity that authenticates software instead of a person. Examples include service accounts, API keys, OAuth tokens issued to applications, cloud roles assumed by machines, and the credentials AI agents use to call tools. Where a human identity logs in with a username and password or passkey, an NHI logs in with a token or key that software holds.

Why NHIs are different

Human identities get attention: onboarding, offboarding, password resets, access reviews. NHIs get created on demand and then forgotten. They rarely expire, they’re shared across systems, and their privileges grow with every integration. An AI agent that can call your payment or cloud APIs is itself a non-human identity — often with more power than any single employee.

Why NHIs matter now

Three trends collided. Cloud and CI/CD made machine-to-machine access universal. AI agents multiplied the number of machines acting autonomously. And attackers learned that stealing a stale API key is easier than breaching a human account. The result: NHIs are now one of the fastest-rising attack surfaces, which is why OWASP published a dedicated Non-Human Identity Top 10.

Where this bites vibecoders
A vibecoder wiring an AI agent into tools usually creates NHIs as an afterthought — a long-lived key pasted into a config file with broad scope, never inventoried. That key is now a permanent, unmonitored door. The discipline is the same as for any identity: least privilege, short lifetimes, an inventory, and rotation. Every key you issue should have an owner and an expiry.

Where AI coding assistants get this wrong

Generating long-lived, over-scoped API keys and storing them in code.
Creating a new service account for every demo instead of reusing scoped identities.
Treating agent credentials as “just a token” with no inventory or audit trail.
Failing to distinguish what an agent can read from what it can modify.

Checklist

Inventory every NHI: what it is, who owns it, what it can access.
Issue least-privilege scopes and short lifetimes for every key.
Rotate keys on a schedule and on suspected exposure.
Store NHI credentials in a secret manager, never in code.
Audit agent actions separately from human actions.

FAQ

What is the difference between an NHI and a service account?

A service account is one kind of NHI — a machine account in a cloud or directory. NHI is the broader category that also includes API keys, OAuth tokens, certificates, and agent credentials. All service accounts are NHIs, but not all NHIs are service accounts.

Why are NHIs riskier than human accounts?

They’re more numerous, often more privileged, rarely expire, and nobody watches them the way they watch human logins. Attackers know a forgotten API key is a low-effort, high-value target.

Do AI agents count as NHIs?

Yes. When an agent authenticates to your systems with a token or role, that credential is a non-human identity — and it can act autonomously, which raises the stakes if it’s compromised or tricked. See What Is Agentic AI Security?.