Configuration

The Dash0 Terraform Provider is configured through the standard providerCopy block plus a set of environment variables. Credentials can also be sourced from a Dash0 CLI profile.

Provider block schema

Environment variables

Environment variables take precedence over the equivalent providerCopy block attributes.

¹ Required unless credentials are supplied through the providerCopy block or a Dash0 CLI profile.

Credential resolution order

The provider resolves credentials in this order and stops at the first source that supplies them:

1. The DASH0_API_URLCopy and DASH0_AUTH_TOKENCopy environment variables. DASH0_URLCopy is accepted as a deprecated fallback when DASH0_API_URLCopy is not set.
2. The urlCopy and auth_tokenCopy attributes on the providerCopy block.
3. A named Dash0 CLI profile — the one named by the profileCopy attribute, or the active profile in ~/.dash0/Copy when profileCopy is unset.

The OTLP endpoint follows the same order (DASH0_OTLP_URLCopy, then otlp_urlCopy, then the profile's otlpUrlCopy) but is resolved independently of the credentials. It is not part of the "credentials are complete" test, so a configuration that supplies the API URL and auth token but no OTLP endpoint is valid — only the log-event actions will fail, and they say so.

The Dash0 credentials can be found under Dash0's settings screens.

Option 1: Environment variables (recommended)

12345678
# see https://app.dash0.com/goto/settings/endpoints?endpoint_type=api_http for the exact URL
export DASH0_API_URL="https://api.xxx.dash0.com"
export DASH0_AUTH_TOKEN="auth_xxxx"
export DASH0_MAX_RETRIES=3  # optional; default 3, max 5

# only needed for the dash0_log_event and dash0_deployment_event actions
# see https://app.dash0.com/goto/settings/endpoints?endpoint_type=otlp_http for the exact URL
export DASH0_OTLP_URL="https://ingress.xxx.dash0.com"

With those set, the providerCopy block only needs the version pin:

12345678910
terraform {
  required_providers {
    dash0 = {
      source  = "dash0hq/dash0"
      version = "~> 1.6"
    }
  }
}

provider "dash0" {}

Option 2: Provider-block attributes

12345678910111213
terraform {
  required_providers {
    dash0 = {
      source  = "dash0hq/dash0"
      version = "~> 1.6"
    }
  }
}

provider "dash0" {
  url        = "https://api.xxx.dash0.com"
  auth_token = "auth_xxxx"
}

Environment variables take precedence over provider-block attributes when both are set.

Option 3: Dash0 CLI profile

When the Dash0 CLI is installed and configured, the provider can load credentials from one of its profiles. Set the profileCopy attribute to pick a named profile, or omit it to fall back to the active profile.

123
provider "dash0" {
  profile = "production"
}

The CLI configuration directory defaults to ~/.dash0Copy; set DASH0_CONFIG_DIRCopy to point at a different location (useful for CI runners or sandboxed environments).

OAuth-enabled profiles

Profiles authenticated via dash0 auth loginCopy (OAuth) are supported for every resource and data source. The provider transparently refreshes the access token when it is close to expiry. If the refresh token itself has expired or been revoked, the provider emits an error asking you to re-authenticate:

1234
Error: OAuth re-authentication required

The OAuth session for your dash0 CLI profile has expired.
Run `dash0 auth login` to re-authenticate, then re-run your Terraform command.