---
sidebar_label: Configure API keys with IaC tools
doc_id: 0ae5b4f6-61d5-4755-bb94-5bd49660ae28
description: >-
  Learn how to create and manage API keys using Infrastructure as Code tools
  like OpenTofu and Terraform.
keywords:
  - API keys
  - Infrastructure as Code
  - Terraform
  - OpenTofu
  - IaC
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# Configure API keys with IaC tools

You can create and manage API keys using Infrastructure as Code (IaC) tools like
[OpenTofu](https://opentofu.org/) or [Terraform](https://developer.hashicorp.com/terraform). We've created a
plugin to help you configure
API keys: [API key resource plugin](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/api_key).

:::info You need an [Admin or Ops role](/docs/authorization/roles) to create and manage API keys.
:::

### Why use IaC for API keys?

Managing API keys with IaC tools helps you:

- Ensure consistent configurations across environments.
- Save time by automating API key setup.
- Track changes with version control.

## Get started

Follow these steps to set up API keys using OpenTofu or Terraform:

:::warning Secure your API keys
- The API key's secret value is **only stored in the `tfstate` file** and **cannot be retrieved again**, even if you import the resource. 
- Ensure the `tfstate` file is **securely stored** and protected from unauthorized access.
:::

1. Create a configuration file.

   Below is an example configuration to set up an API key for the nullplatform API. Replace the placeholder values in the example with your details.

  ```hcl
  terraform {
    required_providers {
      nullplatform = {
        source  = "nullplatform/nullplatform"
      }
    }
  }

  provider "nullplatform" {}

  resource "nullplatform_api_key" "my_api_key" {
    name = "Example API Key Name"

    grants {
      nrn        = "organization=1:account=1"
      role_slug  = "ops"
    }

    grants {
      nrn        = "organization=1:account=1"
      role_slug  = "admin"
    }

    tags {
      key = "example"
      value = "true"
    }
  }

  output "my_api_key_value" {
    value     = nullplatform_api_key.my_api_key.api_key
    sensitive = true
  }
  ```

2. Initialize the IaC tool.

   Run the initialization command for your chosen tool:

   <Tabs>
       <TabItem value="OpenTofu" label="OpenTofu">
           ```bash
           tofu init
           ```
       </TabItem>
       <TabItem value="Terraform" label="Terraform">
           ```bash
           terraform init
           ```
       </TabItem>
   </Tabs>

3. Review your changes.

   Preview the changes before applying them:

   <Tabs>
       <TabItem value="OpenTofu" label="OpenTofu">
           ```bash
           tofu plan
           ```
       </TabItem>
       <TabItem value="Terraform" label="Terraform">
           ```bash
           terraform plan
           ```
       </TabItem>
   </Tabs>

4. Apply the configuration.
   
   If your changes look good, apply the configuration:

    <Tabs>
      <TabItem value="OpenTofu" label="OpenTofu">
          ```bash
          tofu apply
          ```
      </TabItem>
      <TabItem value="Terraform" label="Terraform">
          ```bash
          terraform apply
          ```
      </TabItem>
    </Tabs>

## Verify API keys

After applying the configuration:

1. Navigate to **Platform settings > API keys** in the nullplatform UI.

2. Verify that your API keys are configured correctly.