keenauth_environment_settings

The keenauth_environment_settings resource manages the settings of the environment: languages, time zone, sessions, sign-up, security notifications, account recovery, MFA, Front-Channel Logout and the allowed first factors. Attack protection is not part of these settings.

One object per environment

The settings exist once per environment and always exist. Declare the resource at most once per provider configuration. Creating the resource reads the current settings and writes only what your configuration changes. Destroying it only removes it from state; the environment keeps its settings.

Only what you write is managed

An attribute or group you leave out keeps its current value. Removing an attribute from the configuration keeps its last value. Lists such as allowed_first_factors and signup.email_domains are sets, so their order does not matter.

resource "keenauth_environment_settings" "this" {
  default_zoneinfo      = "Europe/Istanbul"
  allowed_first_factors = ["passkey", "password", "social"]

  locales = {
    enabled = ["en", "tr"]
    default = "en"
  }

  session = {
    idle_timeout_s     = 86400
    absolute_timeout_s = 1209600
  }

  signup = {
    mode              = "open"
    email_domain_mode = "denylist"
    email_domains     = ["mailinator.com"]
  }
}

Groups

Attribute	What it controls
`locales`	Enabled languages and the default language. The default must be enabled.
`default_zoneinfo`	Default IANA time zone.
`session`	Idle and absolute timeouts in seconds, concurrent session limit and what happens at the limit, anomaly action. The idle timeout cannot be greater than the absolute timeout.
`signup`	Sign-up mode and the e-mail domain allowlist or denylist. Write domains in lower case; write internationalized names as A-labels (`xn--…`).
`security_notifications`	Master switch and the events that send a notification e-mail.
`account_recovery`	Recovery mode, waiting period in hours and the support link shown when recovery is disabled.
`mfa`	E-mail as a second factor and its assurance level, TOTP issuer label, recovery codes and their count.
`frontchannel_logout_enabled`	OpenID Connect Front-Channel Logout.
`allowed_first_factors`	First factors allowed in the environment. Application and organization policies can only narrow this set.

Safe changes

An update sends only the changed fields as a JSON merge patch with If-Match. If someone changed the settings after the plan was made, the API answers 412 and nothing changes. Run plan again.
A change made in the dashboard shows up in the next plan as drift, and apply reverts it for the attributes you manage.
Narrowing a policy (shorter sessions, a lower session limit, stricter sign-up or recovery, removing a first factor) applies to new sessions and sign-ins immediately. Existing sessions run to the end of their lifetime.

Import

tofu import keenauth_environment_settings.this environment-settings