terraform-provider-stackgen

sg_credential_provider (Resource)

Manages a 3-legged OAuth Credential Provider in StackGen Vault.

OAuth URLs: Register the Vault OAuth callback URL with your identity provider exactly as documented for your deployment (the redirect target is fixed; it differs from the optional return_uri query parameter on the authorize API, which selects where the browser is sent after OAuth completes).

Example Usage

# When to use: Register a 3-legged OAuth app in Vault so integrations can obtain
# dynamic tokens (GitHub App, Salesforce, …). Wire credential_provider_id into
# sg_guild_integration instead of static secret_ref_ids.
#
# Prerequisites: Register Vault’s callback URL with your IdP; keep client_secret
# in variables / a secrets manager — never commit real values.
#
# Related: sg_guild_integration.credential_provider_id, data.sg_credential_provider.
resource "sg_credential_provider" "example" {
  name          = "github-org-app"
  subcategory   = "github"
  client_id     = "Iv1.exampleclientid"
  client_secret = "replace-with-real-secret"
  token_url     = "https://github.com/login/oauth/access_token"
  auth_url      = "https://github.com/login/oauth/authorize"
  scopes        = ["read:org", "repo"]
}

Import

Import an existing sg_credential_provider using its credential provider name:

terraform import sg_credential_provider.example 'github-oauth'

Vault never returns client_id or client_secret; set the same values in HCL after import.

Operational notes

OAuth client_id and client_secret are sensitive and can persist in Terraform state. Vault never returns them on read/import; supply the same values in HCL after import. Secure state and plans. Integrations can refer to this provider by credential_provider_id after it is created.

Schema

Required

• client_id (String, Sensitive) OAuth client ID (encrypted at rest).
• client_secret (String, Sensitive) OAuth client secret (encrypted at rest).
• name (String) Unique name for this credential provider.
• subcategory (String) Secret subcategory (e.g. github, aws, anthropic).
• token_url (String) OAuth token endpoint URL.

Optional

• auth_url (String) OAuth authorization endpoint URL (for consent redirect).
• extra_token_keys (List of String) Extra token keys to extract.
• scopes (List of String) Default OAuth scopes.

Read-Only

• id (String) Server-assigned identifier.