Configuration

Every kupe_* resource and data source inherits its connection from a single provider "kupe" block: host, tenant, and an API key. Set each argument directly, or leave it out and rely on the matching environment variable.

Provider block

provider "kupe" {
  host    = "https://api.kupe.cloud"   # or KUPE_HOST env var
  tenant  = "my-tenant"                 # or KUPE_TENANT env var
  api_key = var.kupe_api_key            # or KUPE_API_KEY env var
}

Authentication

The provider authenticates with a tenant-scoped API key.

Set via provider config or environment variable:

export KUPE_API_KEY="kupe_abc123_your-secret-key"
terraform plan

Or in the provider block using a variable (never hardcode keys):

variable "kupe_api_key" {
  type      = string
  sensitive = true
}

provider "kupe" {
  host    = "https://api.kupe.cloud"
  tenant  = "my-tenant"
  api_key = var.kupe_api_key
}

Environment variables

All provider arguments can be set via environment variables:

Argument	Environment variable	Description
host	KUPE_HOST	API base URL
tenant	KUPE_TENANT	Your tenant name
api_key	KUPE_API_KEY	API key (preferred)

Creating an API key for Terraform

1. Generate a key in the console for your tenant.
2. Save the key value immediately; it is only shown once.
3. Store it securely (CI/CD secrets, Vault, etc.) and set it as KUPE_API_KEY.

After the provider is already authenticated, you can also manage additional keys with Terraform itself:

resource "kupe_api_key" "terraform" {
  display_name = "Terraform"
  role         = "admin"
}

# Save this output to use as KUPE_API_KEY in other workspaces
output "terraform_api_key" {
  value     = kupe_api_key.terraform.key
  sensitive = true
}