keenauth_branding

The keenauth_branding resource manages the environment theme of the branding draft: colors for the light and dark variants, fonts, corner radius, layout and logo.

Draft, then publish

Changes go to the draft. Publish them in the dashboard or with keenauth branding publish. Publishing releases every branding draft of the environment at once (application and organization themes, texts, custom CSS and page template) and checks contrast, so the provider does not publish on its own. See Brand your login pages.

The branding draft exists once per environment. Declare the resource at most once per provider configuration. Destroying it only removes it from state; the draft and the published versions stay as they are.

Write the complete theme

theme is a JSON object; use jsonencode. It is compared as JSON, so reordering keys gives an empty plan. Tokens you remove from the configuration are cleared and inherit the platform default. JSON null and empty objects are not allowed. If you leave theme out, the current theme is kept.

resource "keenauth_branding" "this" {
  theme = jsonencode({
    mode   = "system"
    layout = "center"
    font   = { size_base = 16 }
    radius = { card = 12, control = 8 }
    light  = { color = { primary = "#4f46e5", background = "#ffffff" } }
    dark   = { color = { primary = "#818cf8", background = "#0b0b0f" } }
  })
}

logo, favicon and background_image take the IDs of uploaded branding assets. Custom CSS and the page template are not managed by this resource.

Safe changes

An update sends only the changed tokens as a JSON merge patch with If-Match. If someone changed the draft after the plan was made, the API answers 412 and nothing changes. Run plan again. A token added in the dashboard shows up as drift, and apply removes it.

Import

tofu import keenauth_branding.this branding