# clerk_api_key (Resource)

An API key for a subject (a user, an organization, or a machine). A key that Clerk marks revoked or expired leaves state on the next refresh, and the next apply creates a replacement.

## Example Usage

```terraform
resource "clerk_api_key" "backend" {
  name    = "backend"
  subject = "user_2abcDEFghiJKLmnoPQRstuVWXyz"
  scopes  = ["read", "write"]

  # Optional: expire the key 90 days from the apply.
  seconds_until_expiration = 90 * 24 * 60 * 60
}

output "backend_api_key" {
  value     = clerk_api_key.backend.secret
  sensitive = true
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) Key name. The API cannot change it: a change forces a replacement.
- `subject` (String) Id of the owner: a user (`user_...`), an organization (`org_...`), or a machine (`mch_...`).

### Optional

- `claims` (String) JSON object with custom claims for the key.
- `description` (String) Free-form description.
- `scopes` (Set of String) Scopes of the key, for example `["read", "write"]`.
- `seconds_until_expiration` (Number) Lifetime of the key in seconds, counted from the moment of the call. Clerk does not return this value; the computed `expiration` timestamp does. Leave it unset for a key without an expiration.

### Read-Only

- `expiration` (Number) Expiration as a unix timestamp. Null for a key without an expiration.
- `id` (String) API key id.
- `secret` (String, Sensitive) The key secret (`ak_...`). Store it in a secret manager, not in plain state files that others can read.
- `type` (String) Key type, normally `api_key`.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
terraform import clerk_api_key.backend ak_2abcDEFghiJKLmnoPQRstuVWXyz
```