Create a CI/CD API Key

Manage CI/CD API keys with Terraform. The raw key is only available immediately after creation — emit it as a sensitive output and pipe it into your CI/CD secret store.

resource "kupe_api_key" "github_actions" {
  display_name = "GitHub Actions"
  role         = "admin"
  expires_at   = "2027-01-01T00:00:00Z"
}

# Store this in your CI/CD secrets
output "github_actions_api_key" {
  value     = kupe_api_key.github_actions.key
  sensitive = true
}

All kupe_api_key arguments are immutable — changing any field forces replacement. The new key is created and the old one is revoked, so plan rotations during low-traffic windows.

For role guidance, key storage, and rotation patterns, see Set Up an API Key for CI/CD.