runr_api_key (Resource)

An API key of a consumer (API keys): callers of key routes send it as X-Api-Key or Authorization: Bearer. The key itself (key) is in the answer that creates it and nowhere else: Terraform keeps it in the state (sensitive), so keep the state safe or hand the key on at once. Name, scopes, plan and expiry change in place; the key stays.

Destroying the resource revokes the key (callers get 401 within the region's sync interval). A key revoked outside Terraform is dropped from the state and created again. Rotation is an action, not a setting: runr gateway keys rotate makes a new key with an overlap; the resource then follows the new key (its key is not in the state; the command printed it).

Import with <consumer id>/<key id>; an imported key has no key (RunR never shows it again).

Example Usage#

# A key of Acme for GET and POST on /orders, valid until the end of 2027.
resource "runr_api_key" "acme_production" {
  consumer_id = runr_api_consumer.acme.id
  name        = "production"
  scopes = [
    { route_id = runr_gateway_route.orders.id, methods = ["GET", "POST"] },
  ]
  expires_at = "2028-01-01T00:00:00Z"
}

# The key is shown only when it is created: hand it to the consumer, e.g. into a secret store.
# Rotate it with `runr gateway keys rotate <key id> --overlap 1440`; the resource follows the
# new key (its key is not in the state then).
output "acme_key" {
  value     = runr_api_key.acme_production.key
  sensitive = true
}

Schema#

Required#

consumer_id (String) Consumer id (runr_api_consumer). Changing it creates a new key.
name (String) Name of the key, e.g. production.

Optional#

expires_at (String) When the key stops working (RFC 3339, e.g. 2027-01-01T00:00:00Z; in the future when it is set). Left out: never. An expired key stays in the state (status = "expired") until the time changes.
plan_id (String) A plan for this key instead of the consumer's (runr_api_plan): its limits are counted for the key alone.
scopes (Attributes List) Routes (and methods) the key may call: routes of the consumer's gateway (any gateway of the organization for an organization consumer). Left out: every route the consumer may call. (see below for nested schema)

Read-Only#

id (String) Key id.
key (String, Sensitive) The key (rk_…), known only from its creation; null after an import or a rotation outside Terraform.
prefix (String) The key's first 11 characters, which tell keys apart.
status (String) active or expired.

Nested Schema for `scopes`#

Required:

route_id (String) Route id (runr_gateway_route).

Optional:

methods (Set of String) Methods on the route (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS). Left out: every method.

Import#

Import is supported using the following syntax:

The terraform import command can be used, for example:

# <consumer id>/<key id> (`runr gateway keys ls <consumer id>`); the key itself is not imported
terraform import runr_api_key.acme_production 01JCONSUMER0123456789ABCDE/01JKEY0123456789ABCDEFGHJK