clerk_api_key (Resource)

An API key for a subject (a user, an organization, or a machine). A key that Clerk marks revoked or expired leaves state on the next refresh, and the next apply creates a replacement.

Example Usage

resource "clerk_api_key" "backend" {
  name    = "backend"
  subject = "user_2abcDEFghiJKLmnoPQRstuVWXyz"
  scopes  = ["read", "write"]

  # Optional: expire the key 90 days from the apply.
  seconds_until_expiration = 90 * 24 * 60 * 60
}

output "backend_api_key" {
  value     = clerk_api_key.backend.secret
  sensitive = true
}

Schema

Required

• name (String) Key name. The API cannot change it: a change forces a replacement.
• subject (String) Id of the owner: a user (user_...), an organization (org_...), or a machine (mch_...).

Optional

• claims (String) JSON object with custom claims for the key.
• description (String) Free-form description.
• scopes (Set of String) Scopes of the key, for example ["read", "write"].
• seconds_until_expiration (Number) Lifetime of the key in seconds, counted from the moment of the call. Clerk does not return this value; the computed expiration timestamp does. Leave it unset for a key without an expiration.

Read-Only

• expiration (Number) Expiration as a unix timestamp. Null for a key without an expiration.
• id (String) API key id.
• secret (String, Sensitive) The key secret (ak_...). Store it in a secret manager, not in plain state files that others can read.
• type (String) Key type, normally api_key.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

terraform import clerk_api_key.backend ak_2abcDEFghiJKLmnoPQRstuVWXyz