diff --git a/cloud/scope/machine.go b/cloud/scope/machine.go
index 30d28f18b..955a2e015 100644
--- a/cloud/scope/machine.go
+++ b/cloud/scope/machine.go
@@ -40,6 +40,7 @@ import (
 
 	infrav1beta2 "sigs.k8s.io/cluster-api-provider-ibmcloud/api/v1beta2"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/globaltagging"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/vpc"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/endpoints"
@@ -1074,10 +1075,10 @@ func (m *MachineScope) SetNotReady() {
 }
 
 // SetProviderID will set the provider id for the machine.
-func (m *MachineScope) SetProviderID(id *string) error {
+func (m *MachineScope) SetProviderID(id *string, jwtParser parser.TokenParser) error {
 	// Based on the ProviderIDFormat version the providerID format will be decided.
 	if options.ProviderIDFormatType(options.ProviderIDFormat) == options.ProviderIDFormatV2 {
-		accountID, err := utils.GetAccountID()
+		accountID, err := utils.GetAccountID(jwtParser)
 		if err != nil {
 			m.Logger.Error(err, "failed to get cloud account id", err.Error())
 			return err
diff --git a/cloud/scope/machine_test.go b/cloud/scope/machine_test.go
index 2a153e857..57161b43c 100644
--- a/cloud/scope/machine_test.go
+++ b/cloud/scope/machine_test.go
@@ -19,10 +19,13 @@ package scope
 import (
 	"context"
 	"errors"
+	"fmt"
+	"os"
 	"testing"
 
 	"github.com/IBM/go-sdk-core/v5/core"
 	"github.com/IBM/vpc-go-sdk/vpcv1"
+	"github.com/golang-jwt/jwt"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
 
@@ -30,12 +33,15 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/klog/v2"
+	"k8s.io/utils/ptr"
 	capiv1beta1 "sigs.k8s.io/cluster-api/api/v1beta1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	infrav1beta2 "sigs.k8s.io/cluster-api-provider-ibmcloud/api/v1beta2"
+	mockParser "sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser/mock"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/vpc/mock"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/options"
 
 	. "github.com/onsi/gomega"
 )
@@ -1059,3 +1065,64 @@ func TestDeleteVPCLoadBalancerPoolMember(t *testing.T) {
 		})
 	})
 }
+
+func TestSetProviderID_Machine(t *testing.T) {
+	setup := func(t *testing.T) (*gomock.Controller, *mockParser.MockTokenParser, *mock.MockVpc) {
+		t.Helper()
+		return gomock.NewController(t), mockParser.NewMockTokenParser(gomock.NewController(t)), mock.NewMockVpc(gomock.NewController(t))
+	}
+
+	t.Run("Set Provider ID in v1 format", func(t *testing.T) {
+		g := NewWithT(t)
+		mockController, mockparser, mockvpc := setup(t)
+		t.Cleanup(mockController.Finish)
+		scope := setupMachineScope(clusterName, machineName, mockvpc)
+		err := scope.SetProviderID(ptr.To("foo-providerID"), mockparser)
+		expectedProviderID := ptr.To(fmt.Sprintf("ibmvpc://%s/%s", scope.Machine.Spec.ClusterName, scope.IBMVPCMachine.Name))
+		g.Expect(*scope.IBMVPCMachine.Spec.ProviderID).To(Equal(*expectedProviderID))
+		g.Expect(err).To(BeNil())
+	})
+	t.Run("Set Provider ID in v2 format, returns error", func(t *testing.T) {
+		g := NewWithT(t)
+		mockController, mockparser, mockvpc := setup(t)
+		t.Cleanup(mockController.Finish)
+		err := os.Setenv("IBMCLOUD", "IBMCLOUD")
+		g.Expect(err).To(BeNil())
+		err = os.Setenv("IBMCLOUD_AUTH_TYPE", "bearerToken")
+		g.Expect(err).To(BeNil())
+		err = os.Setenv("IBMCLOUD_BEARER_TOKEN", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.1DhH-W1bP_u1mEU8UXYQkh6XP1P0TNILV5TVSbWlk74")
+		g.Expect(err).To(BeNil())
+		defer os.Unsetenv("IBMCLOUD")
+		defer os.Unsetenv("IBMCLOUD_AUTH_TYPE")
+		defer os.Unsetenv("IBMCLOUD_BEARER_TOKEN")
+		mockparser.EXPECT().Parse(gomock.Any(), gomock.Any()).Return(nil, fmt.Errorf("parse error"))
+		scope := setupMachineScope(clusterName, machineName, mockvpc)
+		options.ProviderIDFormat = string(options.ProviderIDFormatV2)
+		err = scope.SetProviderID(ptr.To("foo-providerID"), mockparser)
+		g.Expect(err).NotTo(BeNil())
+	})
+
+	t.Run("Set Provider ID in v2 format", func(t *testing.T) {
+		g := NewWithT(t)
+		mockController, mockparser, mockvpc := setup(t)
+		t.Cleanup(mockController.Finish)
+		err := os.Setenv("IBMCLOUD", "IBMCLOUD")
+		g.Expect(err).To(BeNil())
+		err = os.Setenv("IBMCLOUD_AUTH_TYPE", "bearerToken")
+		g.Expect(err).To(BeNil())
+		err = os.Setenv("IBMCLOUD_BEARER_TOKEN", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.1DhH-W1bP_u1mEU8UXYQkh6XP1P0TNILV5TVSbWlk74")
+		g.Expect(err).To(BeNil())
+		defer os.Unsetenv("IBMCLOUD")
+		defer os.Unsetenv("IBMCLOUD_AUTH_TYPE")
+		defer os.Unsetenv("IBMCLOUD_BEARER_TOKEN")
+		mp := make(map[string]interface{})
+		mp["bss"] = "accountID"
+		mockparser.EXPECT().Parse(gomock.Any(), gomock.Any()).Return(&jwt.Token{Claims: jwt.MapClaims{"account": mp}}, nil)
+		scope := setupMachineScope(clusterName, machineName, mockvpc)
+		options.ProviderIDFormat = string(options.ProviderIDFormatV2)
+		err = scope.SetProviderID(ptr.To("foo-providerID"), mockparser)
+		expectedProviderID := ptr.To(fmt.Sprintf("ibm://%s///%s/%s", "accountID", scope.Machine.Spec.ClusterName, "foo-providerID"))
+		g.Expect(*scope.IBMVPCMachine.Spec.ProviderID).To(Equal(*expectedProviderID))
+		g.Expect(err).To(BeNil())
+	})
+}
diff --git a/cloud/scope/powervs_cluster.go b/cloud/scope/powervs_cluster.go
index 44cd64124..16c38cf16 100644
--- a/cloud/scope/powervs_cluster.go
+++ b/cloud/scope/powervs_cluster.go
@@ -50,6 +50,7 @@ import (
 	infrav1beta2 "sigs.k8s.io/cluster-api-provider-ibmcloud/api/v1beta2"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/authenticator"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/cos"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/resourcecontroller"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/resourcemanager"
@@ -2398,7 +2399,7 @@ func (s *PowerVSClusterScope) fetchResourceGroupID() (string, error) {
 		return "", err
 	}
 
-	account, err := utils.GetAccount(auth)
+	account, err := utils.GetAccount(auth, parser.NewJWTService())
 	if err != nil {
 		return "", err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/image/import.go b/cmd/capibmadm/cmd/powervs/image/import.go
index 5c73b23de..c8dac3606 100644
--- a/cmd/capibmadm/cmd/powervs/image/import.go
+++ b/cmd/capibmadm/cmd/powervs/image/import.go
@@ -34,6 +34,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/iam"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -107,7 +108,7 @@ func importimage(ctx context.Context, imageImportOption imageImportOptions) erro
 	log := logf.Log
 	log.Info("Importing PowerVS images: ", "service-instance-id", options.GlobalOptions.ServiceInstanceID)
 
-	accountID, err := utils.GetAccount(iam.GetIAMAuth())
+	accountID, err := utils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/image/list.go b/cmd/capibmadm/cmd/powervs/image/list.go
index 76583b02e..5f23190f6 100644
--- a/cmd/capibmadm/cmd/powervs/image/list.go
+++ b/cmd/capibmadm/cmd/powervs/image/list.go
@@ -33,6 +33,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/printer"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/utils"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	pkgUtils "sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -57,7 +58,7 @@ func listimage(ctx context.Context) error {
 	log := logf.Log
 	log.Info("Listing PowerVS images", "service-instance-id", options.GlobalOptions.ServiceInstanceID)
 
-	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth())
+	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/key/create.go b/cmd/capibmadm/cmd/powervs/key/create.go
index e6d482ee7..3ba06f3d7 100644
--- a/cmd/capibmadm/cmd/powervs/key/create.go
+++ b/cmd/capibmadm/cmd/powervs/key/create.go
@@ -32,6 +32,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/iam"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -89,7 +90,7 @@ func createSSHKey(ctx context.Context, keyCreateOption keyCreateOptions) error {
 	logger := log.Log
 	logger.Info("Creating SSH key...")
 
-	accountID, err := utils.GetAccount(iam.GetIAMAuth())
+	accountID, err := utils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/key/delete.go b/cmd/capibmadm/cmd/powervs/key/delete.go
index d9c39b4e4..04e910d8c 100644
--- a/cmd/capibmadm/cmd/powervs/key/delete.go
+++ b/cmd/capibmadm/cmd/powervs/key/delete.go
@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/iam"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -56,7 +57,7 @@ func deleteSSHKey(ctx context.Context, keyName string) error {
 	logger := log.Log
 	logger.Info("Deleting SSH key...")
 
-	accountID, err := utils.GetAccount(iam.GetIAMAuth())
+	accountID, err := utils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/key/list.go b/cmd/capibmadm/cmd/powervs/key/list.go
index 9ba27cbcc..dd6f4cfe8 100644
--- a/cmd/capibmadm/cmd/powervs/key/list.go
+++ b/cmd/capibmadm/cmd/powervs/key/list.go
@@ -31,6 +31,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/printer"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -56,7 +57,7 @@ func listSSHKeys(ctx context.Context) error {
 	log := logf.Log
 	log.Info("Listing PowerVS SSH Keys", "service-instance-id", options.GlobalOptions.ServiceInstanceID, "zone", options.GlobalOptions.PowerVSZone)
 
-	accountID, err := utils.GetAccount(iam.GetIAMAuth())
+	accountID, err := utils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/network/create.go b/cmd/capibmadm/cmd/powervs/network/create.go
index c5918803b..cea4cd440 100644
--- a/cmd/capibmadm/cmd/powervs/network/create.go
+++ b/cmd/capibmadm/cmd/powervs/network/create.go
@@ -31,6 +31,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/iam"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -84,7 +85,7 @@ func createNetwork(ctx context.Context, netCreateOption networkCreateOptions) er
 	log := logf.Log
 	log.Info("Creating PowerVS network", "service-instance-id", options.GlobalOptions.ServiceInstanceID, "zone", options.GlobalOptions.PowerVSZone)
 
-	accountID, err := utils.GetAccount(iam.GetIAMAuth())
+	accountID, err := utils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/network/delete.go b/cmd/capibmadm/cmd/powervs/network/delete.go
index f7f7a8806..6011ceaff 100644
--- a/cmd/capibmadm/cmd/powervs/network/delete.go
+++ b/cmd/capibmadm/cmd/powervs/network/delete.go
@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/iam"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -56,7 +57,7 @@ func deleteNetwork(ctx context.Context, networkID string) error {
 	log := logf.Log
 	log.Info("Deleting PowerVS network", "service-instance-id", options.GlobalOptions.ServiceInstanceID, "zone", options.GlobalOptions.PowerVSZone)
 
-	accountID, err := utils.GetAccount(iam.GetIAMAuth())
+	accountID, err := utils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/network/list.go b/cmd/capibmadm/cmd/powervs/network/list.go
index 327fe854a..13181712f 100644
--- a/cmd/capibmadm/cmd/powervs/network/list.go
+++ b/cmd/capibmadm/cmd/powervs/network/list.go
@@ -31,6 +31,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/printer"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -56,7 +57,7 @@ func listNetwork(ctx context.Context) error {
 	log := logf.Log
 	log.Info("Listing PowerVS networks", "service-instance-id", options.GlobalOptions.ServiceInstanceID, "zone", options.GlobalOptions.PowerVSZone)
 
-	accountID, err := utils.GetAccount(iam.GetIAMAuth())
+	accountID, err := utils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/port/create.go b/cmd/capibmadm/cmd/powervs/port/create.go
index 3edc9cb95..41151d04c 100644
--- a/cmd/capibmadm/cmd/powervs/port/create.go
+++ b/cmd/capibmadm/cmd/powervs/port/create.go
@@ -33,6 +33,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/printer"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/utils"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	pkgUtils "sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -68,7 +69,7 @@ capibmadm powervs port create --network <netword-id/network-name> --description
 func createPort(ctx context.Context, portCreateOption portCreateOptions) error {
 	logger := log.Log
 	logger.Info("Creating Port ", "Network ID/Name", portCreateOption.network, "IP Address", portCreateOption.ipAddress, "Description", portCreateOption.description, "service-instance-id", options.GlobalOptions.ServiceInstanceID, "zone", options.GlobalOptions.PowerVSZone)
-	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth())
+	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/port/delete.go b/cmd/capibmadm/cmd/powervs/port/delete.go
index 68a373c40..1595c4d05 100755
--- a/cmd/capibmadm/cmd/powervs/port/delete.go
+++ b/cmd/capibmadm/cmd/powervs/port/delete.go
@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/iam"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/powervs"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -62,7 +63,7 @@ capibmadm powervs port delete --port-id <port-id> --network <network-name/networ
 func deletePort(ctx context.Context, portDeleteOption portDeleteOptions) error {
 	log := logf.Log
 	log.Info("Deleting PowerVS network port", "network", portDeleteOption.network, "service-instance-id", options.GlobalOptions.ServiceInstanceID, "port-id", portDeleteOption.portID)
-	accountID, err := utils.GetAccount(iam.GetIAMAuth())
+	accountID, err := utils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/powervs/port/list.go b/cmd/capibmadm/cmd/powervs/port/list.go
index 645d63f1a..f7e66220a 100644
--- a/cmd/capibmadm/cmd/powervs/port/list.go
+++ b/cmd/capibmadm/cmd/powervs/port/list.go
@@ -32,6 +32,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/printer"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/utils"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	pkgUtils "sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -63,7 +64,7 @@ func listPorts(ctx context.Context, network string) error {
 	log := logf.Log
 	log.Info("Listing PowerVS ports", "service-instance-id", options.GlobalOptions.ServiceInstanceID, "network", network)
 
-	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth())
+	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/vpc/image/list.go b/cmd/capibmadm/cmd/vpc/image/list.go
index 051469147..456d21b84 100644
--- a/cmd/capibmadm/cmd/vpc/image/list.go
+++ b/cmd/capibmadm/cmd/vpc/image/list.go
@@ -30,6 +30,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/printer"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/utils"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	pkgUtils "sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -59,7 +60,7 @@ func listImages(ctx context.Context, resourceGroupName string) error {
 		return err
 	}
 
-	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth())
+	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/capibmadm/cmd/vpc/key/create.go b/cmd/capibmadm/cmd/vpc/key/create.go
index 1e581efdb..577150369 100644
--- a/cmd/capibmadm/cmd/vpc/key/create.go
+++ b/cmd/capibmadm/cmd/vpc/key/create.go
@@ -32,6 +32,7 @@ import (
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/clients/vpc"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/options"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cmd/capibmadm/utils"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	pkgUtils "sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -93,7 +94,7 @@ func createKey(ctx context.Context, keyCreateOption keyCreateOptions) error {
 		return err
 	}
 
-	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth())
+	accountID, err := pkgUtils.GetAccount(iam.GetIAMAuth(), parser.NewJWTService())
 	if err != nil {
 		return err
 	}
diff --git a/controllers/ibmvpcmachine_controller.go b/controllers/ibmvpcmachine_controller.go
index 08e4383cf..3f9bf9cbd 100644
--- a/controllers/ibmvpcmachine_controller.go
+++ b/controllers/ibmvpcmachine_controller.go
@@ -39,6 +39,7 @@ import (
 
 	infrav1beta2 "sigs.k8s.io/cluster-api-provider-ibmcloud/api/v1beta2"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/cloud/scope"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/endpoints"
 	capibmrecord "sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/record"
 )
@@ -162,6 +163,7 @@ func (r *IBMVPCMachineReconciler) reconcileNormal(machineScope *scope.MachineSco
 		return ctrl.Result{}, fmt.Errorf("failed to reconcile VSI for IBMVPCMachine %s/%s: %w", machineScope.IBMVPCMachine.Namespace, machineScope.IBMVPCMachine.Name, err)
 	}
 
+	jwtParser := parser.NewJWTService()
 	machineRunning := false
 	if instance != nil {
 		// Attempt to tag the Instance.
@@ -171,7 +173,7 @@ func (r *IBMVPCMachineReconciler) reconcileNormal(machineScope *scope.MachineSco
 
 		// Set available status' for Machine.
 		machineScope.SetInstanceID(*instance.ID)
-		if err := machineScope.SetProviderID(instance.ID); err != nil {
+		if err := machineScope.SetProviderID(instance.ID, jwtParser); err != nil {
 			return ctrl.Result{}, fmt.Errorf("error failed to set machine provider id: %w", err)
 		}
 		machineScope.SetAddresses(instance)
@@ -236,7 +238,7 @@ func (r *IBMVPCMachineReconciler) reconcileNormal(machineScope *scope.MachineSco
 	} else {
 		// Otherwise, default to previous Load Balancer Pool Member configuration.
 		_, ok := machineScope.IBMVPCMachine.Labels[capiv1beta1.MachineControlPlaneNameLabel]
-		if err = machineScope.SetProviderID(instance.ID); err != nil {
+		if err = machineScope.SetProviderID(instance.ID, jwtParser); err != nil {
 			return ctrl.Result{}, fmt.Errorf("failed to set provider id IBMVPCMachine %s/%s: %w", machineScope.IBMVPCMachine.Namespace, machineScope.IBMVPCMachine.Name, err)
 		}
 		if ok {
diff --git a/pkg/cloud/services/globaltagging/service.go b/pkg/cloud/services/globaltagging/service.go
index 9ae455057..1c61aae8b 100644
--- a/pkg/cloud/services/globaltagging/service.go
+++ b/pkg/cloud/services/globaltagging/service.go
@@ -26,6 +26,7 @@ import (
 	"k8s.io/utils/ptr"
 
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/authenticator"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -51,7 +52,7 @@ func (s *Service) AttachTag(options *globaltaggingv1.AttachTagOptions) (*globalt
 
 // GetTagByName returns the Tag with the provided name, if found.
 func (s *Service) GetTagByName(tagName string) (*globaltaggingv1.Tag, error) {
-	accountID, err := utils.GetAccountID()
+	accountID, err := utils.GetAccountID(parser.NewJWTService())
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/cloud/services/parser/doc.go b/pkg/cloud/services/parser/doc.go
new file mode 100644
index 000000000..18254785c
--- /dev/null
+++ b/pkg/cloud/services/parser/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package parser implements Token parser.
+package parser
diff --git a/pkg/cloud/services/parser/jwtservice.go b/pkg/cloud/services/parser/jwtservice.go
new file mode 100644
index 000000000..2a9d2c79a
--- /dev/null
+++ b/pkg/cloud/services/parser/jwtservice.go
@@ -0,0 +1,32 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package parser
+
+import "github.com/golang-jwt/jwt"
+
+// JWTService holds the JWT Service specific information.
+type JWTService struct{}
+
+// NewJWTService returns new service for JWT Token.
+func NewJWTService() TokenParser {
+	return &JWTService{}
+}
+
+// Parse parses JWT Token.
+func (j *JWTService) Parse(token string, fn jwt.Keyfunc) (*jwt.Token, error) {
+	return jwt.Parse(token, fn)
+}
diff --git a/pkg/cloud/services/parser/mock/parser_generated.go b/pkg/cloud/services/parser/mock/parser_generated.go
new file mode 100644
index 000000000..be1b42eaf
--- /dev/null
+++ b/pkg/cloud/services/parser/mock/parser_generated.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./parser.go
+//
+// Generated by this command:
+//
+//	mockgen -source=./parser.go -destination=./mock/parser_generated.go -package=mock
+//
+
+// Package mock is a generated GoMock package.
+package mock
+
+import (
+	reflect "reflect"
+
+	jwt "github.com/golang-jwt/jwt"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockTokenParser is a mock of TokenParser interface.
+type MockTokenParser struct {
+	ctrl     *gomock.Controller
+	recorder *MockTokenParserMockRecorder
+}
+
+// MockTokenParserMockRecorder is the mock recorder for MockTokenParser.
+type MockTokenParserMockRecorder struct {
+	mock *MockTokenParser
+}
+
+// NewMockTokenParser creates a new mock instance.
+func NewMockTokenParser(ctrl *gomock.Controller) *MockTokenParser {
+	mock := &MockTokenParser{ctrl: ctrl}
+	mock.recorder = &MockTokenParserMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockTokenParser) EXPECT() *MockTokenParserMockRecorder {
+	return m.recorder
+}
+
+// Parse mocks base method.
+func (m *MockTokenParser) Parse(token string, fn jwt.Keyfunc) (*jwt.Token, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Parse", token, fn)
+	ret0, _ := ret[0].(*jwt.Token)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Parse indicates an expected call of Parse.
+func (mr *MockTokenParserMockRecorder) Parse(token, fn any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Parse", reflect.TypeOf((*MockTokenParser)(nil).Parse), token, fn)
+}
diff --git a/pkg/cloud/services/parser/parser.go b/pkg/cloud/services/parser/parser.go
new file mode 100644
index 000000000..047af2af9
--- /dev/null
+++ b/pkg/cloud/services/parser/parser.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package parser
+
+import "github.com/golang-jwt/jwt"
+
+//go:generate ../../../../hack/tools/bin/mockgen -source=./parser.go -destination=./mock/parser_generated.go -package=mock
+//go:generate /usr/bin/env bash -c "cat ../../../../hack/boilerplate/boilerplate.generatego.txt ./mock/parser_generated.go > ./mock/_parser_generated.go && mv ./mock/_parser_generated.go ./mock/parser_generated.go"
+
+// TokenParser interface defines a method reuired to parse token.
+type TokenParser interface {
+	Parse(token string, fn jwt.Keyfunc) (*jwt.Token, error)
+}
diff --git a/pkg/cloud/services/powervs/service.go b/pkg/cloud/services/powervs/service.go
index bda8b48de..e1b79da7d 100644
--- a/pkg/cloud/services/powervs/service.go
+++ b/pkg/cloud/services/powervs/service.go
@@ -27,6 +27,7 @@ import (
 	"github.com/IBM-Cloud/power-go-client/power/models"
 
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/authenticator"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -59,7 +60,7 @@ func NewService(options ServiceOptions) (PowerVS, error) {
 		options.Authenticator = auth
 	}
 	if options.UserAccount == "" {
-		account, err := utils.GetAccount(options.Authenticator)
+		account, err := utils.GetAccount(options.Authenticator, parser.NewJWTService())
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/cloud/services/resourcemanager/service.go b/pkg/cloud/services/resourcemanager/service.go
index 09a8ab350..0f09848c8 100644
--- a/pkg/cloud/services/resourcemanager/service.go
+++ b/pkg/cloud/services/resourcemanager/service.go
@@ -24,6 +24,7 @@ import (
 	"github.com/IBM/platform-services-go-sdk/resourcemanagerv2"
 
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/authenticator"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/utils"
 )
 
@@ -65,7 +66,7 @@ func (s *Service) ListResourceGroups(listResourceGroupsOptions *resourcemanagerv
 
 // GetResourceGroupByName returns the Resource Group with the provided name, if found.
 func (s *Service) GetResourceGroupByName(rgName string) (*resourcemanagerv2.ResourceGroup, error) {
-	accountID, err := utils.GetAccountID()
+	accountID, err := utils.GetAccountID(parser.NewJWTService())
 	if err != nil {
 		return nil, fmt.Errorf("failed getting account id for resource group lookup: %w", err)
 	}
diff --git a/pkg/cloud/services/utils/accounts.go b/pkg/cloud/services/utils/accounts.go
index c4fb10645..76cf1715f 100644
--- a/pkg/cloud/services/utils/accounts.go
+++ b/pkg/cloud/services/utils/accounts.go
@@ -26,10 +26,11 @@ import (
 	"github.com/IBM/go-sdk-core/v5/core"
 
 	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/authenticator"
+	"sigs.k8s.io/cluster-api-provider-ibmcloud/pkg/cloud/services/parser"
 )
 
 // GetAccount is function parses the account number from the token and returns it.
-func GetAccount(auth core.Authenticator) (string, error) {
+func GetAccount(auth core.Authenticator, jwtParser parser.TokenParser) (string, error) {
 	// fake request to get a barer token from the request header
 	ctx := context.TODO()
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://example.com", http.NoBody)
@@ -44,7 +45,7 @@ func GetAccount(auth core.Authenticator) (string, error) {
 	if strings.HasPrefix(bearerToken, "Bearer") {
 		bearerToken = bearerToken[7:]
 	}
-	token, err := jwt.Parse(bearerToken, func(_ *jwt.Token) (interface{}, error) {
+	token, err := jwtParser.Parse(bearerToken, func(_ *jwt.Token) (interface{}, error) {
 		return "", nil
 	})
 	if err != nil && !strings.Contains(err.Error(), "key is of invalid type") {
@@ -55,10 +56,10 @@ func GetAccount(auth core.Authenticator) (string, error) {
 }
 
 // GetAccountID will parse and returns user cloud account ID.
-func GetAccountID() (string, error) {
+func GetAccountID(jwtParser parser.TokenParser) (string, error) {
 	auth, err := authenticator.GetAuthenticator()
 	if err != nil {
 		return "", err
 	}
-	return GetAccount(auth)
+	return GetAccount(auth, jwtParser)
 }