intutic_provider_credential Cloud

The workspace's own credential for an upstream LLM provider (bring your own key), stored through PUT /api/v1/workspace/provider-credentials/{provider}. The gateway calls that provider with it instead of the platform's key. The API never returns a stored value, so fields is kept in Terraform state as a sensitive value; protect the state accordingly. A credential replaced or removed outside Terraform shows as a difference when the last four characters the API reports change, and the next apply sends fields again. Changing fields rotates the credential in place; changing provider_id replaces the resource. Destroying it removes the credential, and the workspace goes back to the platform key (or is refused, where the gateway requires a provisioned key). Needs an OWNER or ADMIN key.

Example Usage

# AWS Bedrock with a Bedrock API key; requests name models as bedrock/<model id>.
resource "intutic_provider_credential" "bedrock" {
  provider_id = "bedrock"
  fields = {
    awsRegion = "us-east-1"
    apiKey    = var.bedrock_api_key
  }
}

# Google Vertex AI with a service-account key file; models are vertex/<model>.
resource "intutic_provider_credential" "vertex" {
  provider_id = "vertex_ai"
  fields = {
    projectId          = "acme-ml-prod"
    location           = "us-east5"
    serviceAccountJson = file("${path.module}/sa.json")
  }
}

# Azure OpenAI; requests name a deployment as azure/<deployment>.
resource "intutic_provider_credential" "azure" {
  provider_id = "azure_openai"
  fields = {
    endpoint = "https://acme.openai.azure.com"
    apiKey   = var.azure_openai_api_key
  }
}

variable "bedrock_api_key" {
  type      = string
  sensitive = true
}

variable "azure_openai_api_key" {
  type      = string
  sensitive = true
}

Schema

Required

• fields (Map of String, Sensitive) The credential's fields, which the API never returns. anthropic, openai, gemini, mistral, openrouter, deepseek and cohere take apiKey; azure_openai takes endpoint (https://<resource>.openai.azure.com, .services.ai.azure.com or .cognitiveservices.azure.com) and apiKey; bedrock takes awsRegion and either awsAccessKeyId with awsSecretAccessKey, or apiKey; vertex_ai takes projectId, optionally location, and serviceAccountJson (the key file's contents); ollama takes apiBase. Secret fields are 8 to 512 characters. An imported credential has no fields in state, so the first apply after an import sends them.
• provider_id (String) The upstream provider: one of anthropic, openai, gemini, azure_openai, bedrock, vertex_ai, cohere, mistral, openrouter, deepseek, ollama. Changing it replaces the resource.

Read-Only

• id (String) The provider id, as provider_id.
• last_four (String) The last four characters of the first secret field set (for bedrock, awsAccessKeyId before apiKey), as the dashboard shows them; null for vertex_ai and ollama.
• routing_live (Boolean) Whether the gateway routes requests to this provider today. A credential for a provider that is not live is stored, but nothing calls it yet.
• updated_at (String) When the credential was last saved (RFC 3339).

Import

# Import by provider id. The API never returns the stored credential, so the
# first apply after an import sends the configured fields again.
terraform import intutic_provider_credential.bedrock bedrock