Service accounts
You can now create service accounts: API-only child accounts with their own key and secret, no password and no dashboard login. Use them for CI, so a pipeline never runs on a person's credentials and revoking access is one click. Create one under Service Accounts.