keenauth_api_key

The keenauth_api_key resource tracks a management API key and revokes it on destroy.

Why the provider does not create keys

The API returns the raw key only once, in the response that creates it. A key created by the provider would either be lost or have to be written to the state file. The provider therefore never creates API keys and never sees or stores the raw key. A plan that would create a key fails at plan time.

Create with the CLI, then import

  1. Create the key with keenauth api-keys create.
  2. Store the raw key in your secret manager, for example Vault or a cloud secret manager.
  3. Import the key by its ID:
import {
  to = keenauth_api_key.ci
  id = "key_01j9zq3v8c5m2x7k4t6r1n0b3d"
}

resource "keenauth_api_key" "ci" {
  name        = "ci"
  type        = "restricted"
  permissions = ["applications:read", "users:read"]
  expires_at  = "2027-01-31T00:00:00Z"
}

Never pass the raw key as the import ID.

Keys cannot be changed

Every attribute is optional. If you set one, it must match the key; write expires_at in UTC with Z and whole seconds. To change a key, create a new one with the CLI (or rotate it with keenauth api-keys rotate), import the new key and remove the old resource.

What happens over time