Configuration

Provider Block

provider "kupe" {
  host    = "https://api.kupe.cloud"   # or KUPE_HOST env var
  tenant  = "my-tenant"                 # or KUPE_TENANT env var
  api_key = var.kupe_api_key            # or KUPE_API_KEY env var
}

Authentication

The provider authenticates with a tenant-scoped API key.

Set via provider config or environment variable:

export KUPE_API_KEY="kupe_abc123_your-secret-key"
terraform plan

Or in the provider block using a variable (never hardcode keys):

variable "kupe_api_key" {
  type      = string
  sensitive = true
}

provider "kupe" {
  host    = "https://api.kupe.cloud"
  tenant  = "my-tenant"
  api_key = var.kupe_api_key
}

Environment Variables

All provider arguments can be set via environment variables:

Argument	Environment Variable	Description
host	KUPE_HOST	API base URL
tenant	KUPE_TENANT	Your tenant name
api_key	KUPE_API_KEY	API key (preferred)

Creating an API Key for Terraform

1. Generate a key in the console for your tenant.
2. Save the key value immediately — it is only shown once.
3. Store it securely (CI/CD secrets, Vault, etc.) and set it as KUPE_API_KEY.

After the provider is already authenticated, you can also manage additional keys with Terraform itself:

resource "kupe_api_key" "terraform" {
  display_name = "Terraform"
  role         = "admin"
}

# Save this output to use as KUPE_API_KEY in other workspaces
output "terraform_api_key" {
  value     = kupe_api_key.terraform.key
  sensitive = true
}