Skip to main content
Manages an API key for a Kosli service account. API keys authenticate a service account against the Kosli API. Use this resource to mint and revoke keys for a service account managed with the kosli_service_account resource.
The raw key value is returned only once, at creation time, and is stored in Terraform state as a sensitive value. It is SHA-256 hashed server-side and can never be retrieved again — protect your Terraform state accordingly.
API keys are immutable. Changing description, expires_at, or service_account_name revokes the existing key and creates a new one. On terraform import, the key attribute cannot be populated because the raw value is not retrievable.

​
Example usage

terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Service account that the API key belongs to
resource "kosli_service_account" "ci" {
  name        = "ci-pipeline"
  description = "CI/CD pipeline service account"
  privilege   = "member"
}

# A non-expiring API key
resource "kosli_service_account_api_key" "ci_key" {
  service_account_name = kosli_service_account.ci.name
  description          = "Production CI key"
}

# An API key that expires (RFC3339 timestamp)
resource "kosli_service_account_api_key" "ci_key_expiring" {
  service_account_name = kosli_service_account.ci.name
  description          = "Temporary CI key"
  expires_at           = "2100-01-01T00:00:00Z"
}

# The raw key is only available on creation and is sensitive
output "ci_api_key" {
  value     = kosli_service_account_api_key.ci_key.key
  sensitive = true
}

​
Expiry

The expires_at attribute is an RFC3339 timestamp, e.g. 2100-01-01T00:00:00Z (offsets such as +01:00 are accepted and normalized to UTC). Omit it for a key that never expires. The timestamp must not be in the past. To derive dates dynamically, use Terraform’s built-in functions, e.g. timeadd("2026-01-01T00:00:00Z", "8760h").
All timestamps (expires_at, created_at, last_used_at) are RFC3339 UTC strings. last_used_at is null for a key that has never been used; expires_at is null for a key that never expires.

​
Import

API keys can be imported using the <service_account_name>/<key_id> format: 
# Import an existing API key using the "<service_account_name>/<key_id>" format.
# Note: the raw key value cannot be recovered on import (it is only returned once
# at creation), so the "key" attribute will be empty after import.
terraform import kosli_service_account_api_key.ci_key ci-pipeline/01HXYZ0123456789ABCDEFGHIJ
Because the raw key value is only returned at creation time, the key attribute is empty after an import.

​
Schema

​
Required

  • description (String) Description of the API key (at least one character). Changing this forces creation of a new key.
  • service_account_name (String) Name of the service account this API key belongs to. Changing this forces creation of a new key.

​
Optional

  • expires_at (String) RFC3339 timestamp at which the key expires, e.g. 2100-01-01T00:00:00Z (offsets allowed; whole seconds only). Omit for a key that never expires. Must not be in the past (validated server-side at apply time). Changing this forces creation of a new key. Removing a previously set value from configuration leaves the existing expiry unchanged; to get a non-expiring key again, the key must be recreated (e.g. via terraform taint or by changing another argument).

​
Read-only

  • created_at (String) RFC3339 UTC timestamp of when the API key was created.
  • id (String) Server-assigned identifier of the API key.
  • key (String, Sensitive) The raw API key value. Only available at creation time and stored as a sensitive value. Empty when the resource is imported.
  • last_used_at (String) RFC3339 UTC timestamp of when the API key was last used. Null if the key has never been used.
Last modified on July 10, 2026