dash0_auth_token

Manages a Dash0 auth token. Auth tokens are organization-level credentials for the Dash0 API and for telemetry ingestion.

The secret is generated by Dash0, returned only when the token is created, and cannot change. Imported tokens have no secret in the state. To rotate it, replace the resource with terraform apply -replace=dash0_auth_token.<name>. The name, actions, and dataset and signal restrictions update in place. The origin cannot change.

Example Usage

# Manage a Dash0 auth token declaratively. Auth tokens are organization-level
# credentials for telemetry ingestion and the Dash0 API.
#
# Managing auth tokens requires an admin user or a token with the `*` action
# and no dataset or signal restriction.
#
# Do not set spec.token. Dash0 generates the secret; read it from the
# sensitive `token` attribute. The secret is stored in the Terraform state in
# plain text.
resource "dash0_auth_token" "ingest" {
  auth_token_yaml = <<-YAML
apiVersion: dash0.com/v1alpha1
kind: Dash0AuthToken
metadata:
  name: Production ingestion
spec:
  actions:
    - ingest:spans
    - ingest:logs
    - ingest:metrics
YAML
}

# The secret, for example to configure an OpenTelemetry Collector.
output "ingest_token" {
  value     = dash0_auth_token.ingest.token
  sensitive = true
}

# To rotate the secret, replace the resource:
#
#   terraform apply -replace=dash0_auth_token.ingest

# You can also load the YAML definition from a file:
#
# resource "dash0_auth_token" "ingest" {
#   auth_token_yaml = file("${path.module}/auth-tokens/ingest.yaml")
# }

Rotating the secret

The secret cannot change in place. To rotate it, replace the resource:

terraform apply -replace=dash0_auth_token.ingest

Destroying an auth token

Dash0 refuses to delete the last auth token of an organization. Destroying it fails with the API error. Keep at least one other auth token before you destroy it.

Schema

Required

• auth_token_yaml (String) The auth token definition in YAML format, with apiVersion: dash0.com/v1alpha1, kind: Dash0AuthToken, metadata.name for the display name, and spec.actions for the permissions. Optional spec fields are ingestion.defaultDataset, scope.datasets (restriction and slugs), and scope.signals (restriction and types). Omitted optional fields keep the server's values without causing a diff. Do not set spec.token: the secret is exposed through the token attribute.

Read-Only

• id (String) The auth token ID (a UUID), assigned by Dash0.
• origin (String) A unique identifier for the auth token, generated by the provider on creation. Null for auth tokens imported without an origin.
• token (String, Sensitive) The secret of the auth token, assigned by Dash0. Use it as the bearer token or ingestion token. Dash0 returns the secret only when the token is created, so it is only available for tokens created by Terraform. Imported tokens have a null token.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

#!/bin/bash
# Auth tokens are organization-scoped, so the import ID has no dataset prefix.
# Use the auth token ID (a UUID) or its origin.
terraform import dash0_auth_token.ingest 5f1c4a52-7a6e-4c4e-9d0e-3f6a1b2c3d4e

Dash0 returns the secret only when it creates the token, so an imported token has a null token attribute. Terraform manages it, but cannot read its secret.