service keys; can authenticate with service keys; cli can manage service keys