Configuration

The Dash0 Terraform Provider is configured through the standard provider block plus a set of environment variables. Credentials can also be sourced from a Dash0 CLI profile.

Provider block schema

Environment variables

Environment variables take precedence over the equivalent provider block attributes.

¹ Required unless credentials are supplied through the provider block or a Dash0 CLI profile.

Credential resolution order

The provider resolves credentials in this order and stops at the first source that supplies them:

1. The DASH0_API_URL and DASH0_AUTH_TOKEN environment variables. DASH0_URL is accepted as a deprecated fallback when DASH0_API_URL is not set.
2. The url and auth_token attributes on the provider block.
3. A named Dash0 CLI profile — the one named by the profile attribute, or the active profile in ~/.dash0/ when profile is unset.

The OTLP endpoint follows the same order (DASH0_OTLP_URL, then otlp_url, then the profile's otlpUrl) but is resolved independently of the credentials. It is not part of the "credentials are complete" test, so a configuration that supplies the API URL and auth token but no OTLP endpoint is valid — only the log-event actions will fail, and they say so.

The Dash0 credentials can be found under Dash0's settings screens.

Option 1: Environment variables (recommended)

# see https://app.dash0.com/goto/settings/endpoints?endpoint_type=api_http for the exact URL
export DASH0_API_URL="https://api.xxx.dash0.com"
export DASH0_AUTH_TOKEN="auth_xxxx"
export DASH0_MAX_RETRIES=3  # optional; default 3, max 5

# only needed for the dash0_log_event and dash0_deployment_event actions
# see https://app.dash0.com/goto/settings/endpoints?endpoint_type=otlp_http for the exact URL
export DASH0_OTLP_URL="https://ingress.xxx.dash0.com"

With those set, the provider block only needs the version pin:

terraform {
  required_providers {
    dash0 = {
      source  = "dash0hq/dash0"
      version = "~> 1.6"
    }
  }
}

provider "dash0" {}

Option 2: Provider-block attributes

terraform {
  required_providers {
    dash0 = {
      source  = "dash0hq/dash0"
      version = "~> 1.6"
    }
  }
}

provider "dash0" {
  url        = "https://api.xxx.dash0.com"
  auth_token = "auth_xxxx"
}

Environment variables take precedence over provider-block attributes when both are set.

Option 3: Dash0 CLI profile

When the Dash0 CLI is installed and configured, the provider can load credentials from one of its profiles. Set the profile attribute to pick a named profile, or omit it to fall back to the active profile.

provider "dash0" {
  profile = "production"
}

The CLI configuration directory defaults to ~/.dash0; set DASH0_CONFIG_DIR to point at a different location (useful for CI runners or sandboxed environments).

OAuth-enabled profiles

Profiles authenticated via dash0 auth login (OAuth) are supported for every resource and data source. The provider transparently refreshes the access token when it is close to expiry. If the refresh token itself has expired or been revoked, the provider emits an error asking you to re-authenticate:

Error: OAuth re-authentication required

The OAuth session for your dash0 CLI profile has expired.
Run `dash0 auth login` to re-authenticate, then re-run your Terraform command.

Default dataset

Every dataset-scoped resource (dash0_dashboard, dash0_check_rule, dash0_recording_rule, dash0_spam_filter, dash0_synthetic_check, dash0_time_series_aggregation, dash0_view) accepts its own dataset attribute. That attribute is optional: when a resource omits it, the resource inherits the provider-level default instead.

The default resolves in this order and stops at the first source that supplies it:

1. The DASH0_DATASET environment variable.
2. The dataset attribute on the provider block.
3. The dataset configured on the resolved Dash0 CLI profile.
4. "default".

provider "dash0" {
  dataset = "production"
}

resource "dash0_dashboard" "checkout" {
  # No dataset needed -- inherits "production" from the provider block.
  dashboard_yaml = file("checkout.yaml")
}

resource "dash0_dashboard" "staging_canary" {
  dataset        = "staging" # Still overridable per resource.
  dashboard_yaml = file("canary.yaml")
}