diff --git a/src/content/docs/developer-tools/about/our-sdks.mdx b/src/content/docs/developer-tools/about/our-sdks.mdx index bcc316414..0da476c14 100644 --- a/src/content/docs/developer-tools/about/our-sdks.mdx +++ b/src/content/docs/developer-tools/about/our-sdks.mdx @@ -90,6 +90,7 @@ Visit your preferred SDK page below to get started. You can also use [Kinde with ## Other - [Node/Apollo GraphQL](/developer-tools/sdks/backend/apollo-graphql/) +- [Terraform provider](/developer-tools/guides/terraform-provider/) - [Node/Express GraphQL](/developer-tools/sdks/backend/node-express-graphql/) ## Community SDKs diff --git a/src/content/docs/developer-tools/guides/manage-kinde-configuration.mdx b/src/content/docs/developer-tools/guides/manage-kinde-configuration.mdx index 23f637837..7a1231235 100644 --- a/src/content/docs/developer-tools/guides/manage-kinde-configuration.mdx +++ b/src/content/docs/developer-tools/guides/manage-kinde-configuration.mdx @@ -1,13 +1,14 @@ --- page_id: 37e847e2-b6c7-4cf1-86d3-7c607b2bffbd title: Manage Kinde configuration as code across environments -description: Learn how to manage Kinde configurations as code across environments using the Kinde Management API and a JavaScript seeding script. +description: Learn how to manage Kinde configurations as code across environments using the Kinde Management API, a JavaScript seeding script, or the Kinde Terraform provider. sidebar: order: 8 label: Kinde config as code tableOfContents: maxHeadingLevel: 3 relatedArticles: + - f6886655-e356-4abb-bf0a-6d69d9503178 - 50284476-2442-414c-af20-01ed3ef4ca4e - 51899f7f-3436-46e0-9a1b-6ecc3603a0df - 6bf993fc-a195-4836-8eaf-133812be8876 @@ -36,17 +37,17 @@ keywords: - infrastructure as code - terraform - terraform provider - - kinde community provider + - kinde-oss/kinde - github actions - ci automation - workflow dispatch - local-exec - null_resource - terraform workspaces -updated: 2026-05-15 +updated: 2026-08-21 featured: false deprecated: false -ai_summary: "This guide explains how to manage Kinde configuration as code across multiple environments — development, staging, and production — so you never have to manually recreate settings. It covers three approaches: a JavaScript seeding script, Terraform Infrastructure as Code, and a GitHub Actions CI workflow. The seed script uses the Kinde Management API with M2M app credentials to create applications with redirect and logout URLs, environment variables, feature flags, APIs and scopes, and roles with permissions — all driven by per-environment JSON config files. For Terraform, the guide covers two options: using a community Kinde Terraform provider to declare resources directly in HCL, or invoking the Node seed script via a null_resource local-exec provisioner using Terraform workspaces. The GitHub Actions section shows how to configure a workflow_dispatch workflow that lets you trigger seeding for any environment using GitHub repository secrets. The guide includes expected terminal output for each approach, screenshots for verifying results in the Kinde dashboard, and FAQs on limitations, what resources to manage as code, and how to create additional Kinde environments." +ai_summary: "This guide explains how to manage Kinde configuration as code across multiple environments — development, staging, and production — so you never have to manually recreate settings. It covers three approaches: a JavaScript seeding script, Terraform Infrastructure as Code, and a GitHub Actions CI workflow. The seed script uses the Kinde Management API with M2M app credentials to create applications with redirect and logout URLs, environment variables, feature flags, APIs and scopes, and roles with permissions — all driven by per-environment JSON config files. For Terraform, the guide covers two options: using the Kinde Terraform provider (kinde-oss/kinde) to declare resources directly in HCL, or invoking the Node seed script via a null_resource local-exec provisioner using Terraform workspaces for settings the provider does not cover yet. The GitHub Actions section shows how to configure a workflow_dispatch workflow that lets you trigger seeding for any environment using GitHub repository secrets. The guide includes expected terminal output for each approach, screenshots for verifying results in the Kinde dashboard, and FAQs on limitations, what resources to manage as code, and how to create additional Kinde environments." --- Kinde environments are isolated — configuration doesn’t automatically carry over between dev, staging, and production. This guide shows you how to treat your Kinde setup like infrastructure: define it once as JSON, then use a JavaScript seeding script with the Kinde Management API to apply it consistently across environments. @@ -421,15 +422,17 @@ Kinde environments are isolated — configuration doesn’t automatically carry ## Terraform IaC -If you prefer to use Terraform as Infrastructure as Code, there are two options you can consider: +If you prefer to manage Kinde with Terraform, there are two options. You can combine them, but give every resource exactly one owner: let Terraform manage applications, APIs, connections, organizations, users, roles, and permissions, and limit the seed script to settings the provider does not support yet — environment variables, feature flags, and API scopes. If both tools create the same resource types, you get duplicates and drift. When combining, remove the sections the provider owns (such as `application`, `apis`, and `roles`) from your seed config files. -### Option 1: Terraform with Kinde community provider +### Option 1: Kinde Terraform provider -There is a community [Terraform provider for Kinde](https://registry.terraform.io/providers/axatol/kinde/0.0.1/docs/resources/api). It supports configuring the provider with domain and audience, and you can alias providers per environment. Treat it as community software, pin versions, and verify resource coverage in non-prod first. +Kinde maintains a [Terraform provider](https://registry.terraform.io/providers/kinde-oss/kinde/latest) that manages applications, APIs, connections, organizations, users, roles, and permissions directly in HCL. For the full setup, the scopes each resource needs, and how to import existing configuration, see [Manage Kinde with the Terraform provider](/developer-tools/guides/terraform-provider/). -1. Enable the following additional scopes to your M2M application: +The example below creates the same Orders API as the seed script. + +1. Grant your M2M application the scopes for the resources you manage. For this example: + - `create:apis` - `read:apis` - - `update:apis` - `delete:apis` 2. Create the following files with the bash command: @@ -444,8 +447,8 @@ There is a community [Terraform provider for Kinde](https://registry.terraform.i terraform { required_providers { kinde = { - source = "axatol/kinde" - version = "0.0.1" + source = "kinde-oss/kinde" + version = "~> 0.1.0" } } } @@ -465,17 +468,19 @@ There is a community [Terraform provider for Kinde](https://registry.terraform.i 5. Enter the following code in `variables.tf` and save changes. ```hcl - variable kinde_domain {} - variable kinde_audience {} - variable kinde_client_id {} - variable kinde_client_secret {} + variable "kinde_domain" {} + variable "kinde_audience" {} + variable "kinde_client_id" {} + variable "kinde_client_secret" { + sensitive = true + } ``` 6. Enter the following code in `main.tf` and save changes. ```hcl resource "kinde_api" "orders" { - name = "Orders API" + name = "Orders API" audience = "orders" } ``` @@ -486,7 +491,7 @@ There is a community [Terraform provider for Kinde](https://registry.terraform.i terraform init ``` -8. Create environment variables with the following bash command. +8. Create environment variables with the following bash command. The domain must include `https://`. ```bash export TF_VAR_kinde_domain="https://.kinde.com" @@ -513,9 +518,10 @@ You will see a success message. # kinde_api.orders will be created + resource "kinde_api" "orders" { - + audience = "orders" - + id = (known after apply) - + name = "Orders API" + + audience = "orders" + + id = (known after apply) + + is_management_api = (known after apply) + + name = "Orders API" } Plan: 1 to add, 0 to change, 0 to destroy. @@ -532,13 +538,13 @@ You will see a success message. This will create an Orders API in your Kinde environment. -From here, add the resources that the provider currently supports and split values by workspace or `tfvars` files. Use Terraform workspaces or separate states to keep environments isolated. +From here, add the other resources the provider supports — applications, connections, organizations, users, roles, and permissions — and split values by workspace or `tfvars` files. Use Terraform workspaces or separate states to keep environments isolated. If you pass providers down to modules, remember provider alias rules in Terraform. ### Option 2: Terraform with seed script -If the provider’s resource coverage is not yet enough, you can still keep everything in Terraform by invoking the Node seed in `local-exec`. This preserves a single IaC entry point. +For settings the provider does not manage yet — such as environment variables, feature flags, and API scopes — you can still keep a single Terraform entry point by invoking the Node seed script from a `null_resource` with `local-exec`. 1. Inside your original scripts directory, initialize Terraform with the command. diff --git a/src/content/docs/developer-tools/guides/terraform-provider.mdx b/src/content/docs/developer-tools/guides/terraform-provider.mdx new file mode 100644 index 000000000..a8ab47e12 --- /dev/null +++ b/src/content/docs/developer-tools/guides/terraform-provider.mdx @@ -0,0 +1,456 @@ +--- +page_id: f6886655-e356-4abb-bf0a-6d69d9503178 +title: Manage Kinde with the Terraform provider +description: "Use the Kinde Terraform provider to manage applications, APIs, connections, organizations, users, roles, and permissions as code, with M2M authentication, required scopes, and import support." +sidebar: + order: 10 + label: Terraform provider +tableOfContents: + maxHeadingLevel: 3 +relatedArticles: + - 37e847e2-b6c7-4cf1-86d3-7c607b2bffbd + - 50284476-2442-414c-af20-01ed3ef4ca4e + - 6bf993fc-a195-4836-8eaf-133812be8876 + - d95a8edd-f61a-4095-a80e-ffd67f90a438 + - 601dd8c5-6ee1-474f-ad36-201e65280462 +app_context: + - m: settings + s: applications +topics: + - developer-tools + - kinde-api + - sdks + - terraform + - infrastructure-as-code +sdk: + - terraform + - kinde-management-api +languages: + - hcl + - bash +audience: + - developers + - devops +complexity: intermediate +keywords: + - terraform + - terraform provider + - kinde-oss/kinde + - infrastructure as code + - configuration as code + - IaC + - HCL + - terraform import + - terraform registry + - m2m application + - management api scopes + - applications + - apis + - connections + - organizations + - users + - roles + - permissions + - multi-environment setup + - terraform workspaces +updated: 2026-08-21 +featured: false +deprecated: false +ai_summary: "The Kinde Terraform provider (kinde-oss/kinde on the Terraform Registry) lets you manage a Kinde business as code using the standard plan and apply workflow. It is built on the Kinde Management API and authenticates as a machine-to-machine (M2M) application using a domain, audience, client ID, and client secret, all of which can be supplied through KINDE_DOMAIN, KINDE_AUDIENCE, KINDE_CLIENT_ID, and KINDE_CLIENT_SECRET environment variables. The provider ships ten resources — kinde_api, kinde_application, kinde_application_connection, kinde_connection, kinde_organization, kinde_organization_user, kinde_permission, kinde_role, kinde_user, and kinde_user_role — and three data sources: kinde_api, kinde_application, and kinde_connections. This guide starts with a quickstart that creates an M2M application, installs and configures the provider, and applies a first permission and role. Later sections cover the resource-specific Management API scopes, provider configuration, managing applications, adding users to organizations with role assignments, enabling connections on applications, importing existing Kinde configuration including composite import IDs, managing multiple Kinde environments, and behavioral notes such as attributes that force replacement, required fields, and sensitive values stored in Terraform state." +--- + +{/* @case-police-ignore Api */} + +Manage your Kinde business as code — applications, APIs, connections, organizations, users, roles, and permissions — with the [Kinde Terraform provider](https://registry.terraform.io/providers/kinde-oss/kinde/latest) ([source on GitHub](https://github.com/kinde-oss/terraform-provider-kinde)). + +### What you need + +- A [Kinde](/get-started/guides/first-things-first/) account with **Admin** or **Engineer** access (Sign up for free) +- [Terraform](https://developer.hashicorp.com/terraform/install) version 1.0 or higher +- An M2M application authorized for the **Kinde Management API** — see [Set up Kinde Management API access](/developer-tools/kinde-api/connect-to-kinde-api/) + +## Quickstart + +### 1. Create an M2M application + +The provider authenticates as a machine-to-machine (M2M) application. + +1. In Kinde, go to **Settings > Applications**, add a **Machine to Machine** application, and authorize it for the **Kinde Management API**. See the [quick start guide](/developer-tools/kinde-api/connect-to-kinde-api/) for the full steps. +2. Grant the following scopes, which cover the permission and role created in this quickstart: + + ```text + create:permissions read:permissions update:permissions delete:permissions + create:roles read:roles update:roles delete:roles + read:role_permissions update:role_permissions delete:role_permissions + ``` + + Each resource needs its own scopes — see [Required scopes](#required-scopes) for the full list. + +3. Select **View details** on the application and copy the **Domain**, **Client ID**, and **Client secret**. + +### 2. Install the provider + +Add the provider to your configuration, then initialize the working directory. + +```hcl title="versions.tf" +terraform { + required_providers { + kinde = { + source = "kinde-oss/kinde" + version = "~> 0.1.0" + } + } +} +``` + +```bash +terraform init +``` + +### 3. Configure authentication + +Export your M2M credentials as environment variables. Include the `https://` scheme in the domain. The audience is your domain followed by `/api`. + +```bash +export KINDE_DOMAIN="https://.kinde.com" +export KINDE_AUDIENCE="https://.kinde.com/api" +export KINDE_CLIENT_ID="" +read -rs KINDE_CLIENT_SECRET && export KINDE_CLIENT_SECRET +``` + +The `read -rs` prompt keeps the client secret out of your shell history — paste the secret when prompted. In CI, inject all four values from your secret store. + +With the environment variables set, the provider block can be empty. + +```hcl title="provider.tf" +provider "kinde" {} +``` + +### 4. Create a permission and a role + +```hcl title="main.tf" +resource "kinde_permission" "read_billing" { + name = "Read billing" + key = "read:billing" + description = "Grants read access to billing" +} + +resource "kinde_role" "finance" { + name = "Finance" + key = "finance" + description = "Finance team role" + permissions = [kinde_permission.read_billing.id] +} +``` + +### 5. Apply + +```bash +terraform apply +``` + +```text title="Terminal output" +kinde_permission.read_billing: Creating... +kinde_permission.read_billing: Creation complete after 1s [id=] +kinde_role.finance: Creating... +kinde_role.finance: Creation complete after 1s [id=] + +Apply complete! Resources: 2 added, 0 changed, 0 destroyed. +``` + +### 6. Verify in Kinde + +Go to **Settings > Roles** and **Settings > Permissions** to see the new role and permission. Make sure you are viewing the environment your M2M application belongs to. + +Run `terraform plan` again at any time to detect drift between your configuration and what is in Kinde. + +## Required scopes + +Management API scopes are resource-specific. Grant only the scopes for the resources in your configuration. + +| Resource | Required scopes | +| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | +| `kinde_api` | `create:apis`, `read:apis`, `delete:apis` | +| `kinde_application` | `create:applications`, `read:applications`, `update:applications`, `delete:applications` | +| `kinde_application_connection` | `create:application_connections`, `read:application_connections`, `delete:application_connections` | +| `kinde_connection` | `create:connections`, `read:connections`, `update:connections`, `delete:connections` | +| `kinde_organization` | `create:organizations`, `read:organizations`, `update:organizations`, `delete:organizations` | +| `kinde_organization_user` | `create:organization_users`, `read:organization_users`, `update:organization_users`, `delete:organization_users` | +| `kinde_permission` | `create:permissions`, `read:permissions`, `update:permissions`, `delete:permissions` | +| `kinde_role` | `create:roles`, `read:roles`, `update:roles`, `delete:roles`, `read:role_permissions`, `update:role_permissions`, `delete:role_permissions` | +| `kinde_user` | `create:users`, `read:users`, `update:users`, `delete:users`, `create:user_identities`, `read:user_identities` | +| `kinde_user_role` | `create:organization_user_roles`, `read:organization_user_roles`, `delete:organization_user_roles` | + +| Data source | Required scopes | +| ------------------- | ------------------- | +| `kinde_api` | `read:apis` | +| `kinde_application` | `read:applications` | +| `kinde_connections` | `read:connections` | + +Setting the `roles` attribute on `kinde_organization_user` also requires the `organization_user_roles` scopes listed for `kinde_user_role`. `kinde_api` has no update scope because the Kinde API does not support updating an API — changing one replaces it. + + + +## Provider configuration + +Every attribute can be set in the provider block or through the environment. Attributes take precedence over environment variables. + +| Attribute | Environment variable | +| --------------- | --------------------- | +| `domain` | `KINDE_DOMAIN` | +| `audience` | `KINDE_AUDIENCE` | +| `client_id` | `KINDE_CLIENT_ID` | +| `client_secret` | `KINDE_CLIENT_SECRET` | + +```hcl title="provider.tf" +provider "kinde" { + domain = var.kinde_domain + audience = var.kinde_audience + client_id = var.kinde_client_id + client_secret = var.kinde_client_secret +} +``` + + + +## Manage applications + +Register an application with its callback URLs. Kinde issues the client ID and secret, which you can reference as outputs. + +```hcl title="applications.tf" +resource "kinde_application" "web" { + name = "Web app" + type = "reg" + login_uri = "https://example.com/oauth/login" + homepage_uri = "https://example.com" + logout_uris = ["https://example.com/oauth/logout"] + redirect_uris = ["https://example.com/oauth/callback"] +} + +output "web_app_client_id" { + value = kinde_application.web.client_id +} +``` + +Application `type` is one of `reg` (back-end web app), `spa` (single-page app), or `m2m` (machine-to-machine). Changing `name` or `type` forces a replacement, which issues a new client ID and secret — the URIs are updatable in place. + +## Add users to organizations and assign roles + +Memberships and role assignments are separate resources. Because a role can only be assigned to a user who is already a member of the organization, declare the ordering with `depends_on`. + +```hcl title="organizations.tf" +resource "kinde_organization" "acme" { + name = "Acme" +} + +resource "kinde_user" "jane" { + first_name = "Jane" + last_name = "Doe" + + identities = [ + { + type = "email" + value = "jane@example.com" + } + ] +} + +resource "kinde_organization_user" "jane_acme" { + organization_code = kinde_organization.acme.code + user_id = kinde_user.jane.id + + # kinde_user_role manages role assignments for this membership. + lifecycle { + ignore_changes = [roles] + } +} + +resource "kinde_user_role" "jane_finance" { + organization_code = kinde_organization.acme.code + user_id = kinde_user.jane.id + role_id = kinde_role.finance.id + + # A user must be a member of the organization before roles can be assigned. + depends_on = [kinde_organization_user.jane_acme] +} +``` + +Choose one way to manage roles for a membership: + +- **`kinde_user_role`** (shown above): one resource per assignment. Add `ignore_changes = [roles]` to the membership so the two resources do not fight over the same list. +- **`roles` on `kinde_organization_user`**: pass the full list of role IDs on the membership itself, and do not create `kinde_user_role` resources for that user. + +A `kinde_user` needs a `first_name`, a `last_name`, and at least one `email` identity. You can add `username` and `phone` identities alongside it. Social and enterprise identities are created when a user signs in and are not managed by Terraform. + +## Enable connections on an application + +Use the `kinde_connections` data source to look up built-in connections, or create a social connection with `kinde_connection`, then enable it on an application with `kinde_application_connection`. + +```hcl title="connections.tf" +# Look up a built-in connection by strategy +data "kinde_connections" "builtin" { + filter = "builtin" +} + +locals { + password_connection_id = one([ + for c in data.kinde_connections.builtin.connections : c.id + if c.strategy == "username:password" + ]) +} + +resource "kinde_application_connection" "web_password" { + application_id = kinde_application.web.id + connection_id = local.password_connection_id +} + +# Create a social connection and enable it +resource "kinde_connection" "google" { + name = "google" + display_name = "Google" + strategy = "oauth2:google" + + options = { + client_id = var.google_client_id + client_secret = var.google_client_secret + } +} + +resource "kinde_application_connection" "web_google" { + application_id = kinde_application.web.id + connection_id = kinde_connection.google.id +} +``` + +The `filter` attribute accepts `builtin`, `custom`, or `all`. Connection `strategy` values follow the Management API, for example `email:otp`, `username:password`, `oauth2:google`, `oauth2:github`, `oauth2:azure_ad`, and `saml:custom`. + +## Resources and data sources + +Full schema documentation for every resource and data source is on the [Terraform Registry](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs). + +| Resource | Description | +| -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | +| [`kinde_api`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/api) | APIs registered with your business | +| [`kinde_application`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/application) | Applications (`reg`, `spa`, or `m2m`), including login, homepage, redirect, and logout URIs | +| [`kinde_application_connection`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/application_connection) | Enables a connection on an application | +| [`kinde_connection`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/connection) | Social and enterprise identity connections | +| [`kinde_organization`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/organization) | Organizations, including theme colors and handle | +| [`kinde_organization_user`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/organization_user) | Membership of a user in an organization | +| [`kinde_permission`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/permission) | Permissions | +| [`kinde_role`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/role) | Roles and their assigned permissions | +| [`kinde_user`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/user) | Users and their identities | +| [`kinde_user_role`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/resources/user_role) | Assignment of a role to a user in an organization | + +| Data source | Description | +| ------------------------------------------------------------------------------------------------------------------- | ------------------------------------- | +| [`kinde_api`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/data-sources/api) | Look up an existing API by ID | +| [`kinde_application`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/data-sources/application) | Look up an existing application by ID | +| [`kinde_connections`](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs/data-sources/connections) | List connections in your business | + +### Behavior to know about + +- **Some changes force replacement.** Changing the `name` or `audience` of a `kinde_api`, the `name` or `type` of a `kinde_application`, or the `strategy` of a `kinde_connection` destroys and recreates the resource, because the Management API does not support updating those fields. A replaced application gets a new client ID and client secret. +- **`kinde_role` requires a `description`.** The Management API cannot unset a description once it is set, so the provider requires one to avoid state drift. +- **`kinde_user` restrictions.** `is_suspended` cannot be `true` when creating a user — create the user first, then update it. `organization_code` is sent only on create. +- **Large lists are read in full.** Roles, permissions, and other list endpoints are paginated by the provider, so nothing is silently truncated. +- **Create rollback is best effort and resource-scoped.** If a single resource's multi-step create fails part way — for example, `kinde_organization_user` adds the membership but one of its `roles` fails — the provider attempts to remove what that resource created. It does not span resources: a failed `kinde_user_role` does not remove the membership it depends on. After an apply error, run `terraform plan` to see what exists before resuming or destroying. +- **Rate limits apply.** The provider calls the Management API, so large applies are subject to [API rate limits](/developer-tools/kinde-api/api-rate-limits/). + +## Import existing resources + +Every resource supports `terraform import`, so you can bring existing Kinde configuration under Terraform management. + +1. Add a resource block that matches the existing object. +2. Import it using its Kinde ID. Find IDs in the Kinde dashboard or through the [Management API](/kinde-apis/management/). + + ```bash + terraform import kinde_role.finance + ``` + + On Terraform 1.5 or later you can use an `import` block instead and generate the configuration with `terraform plan -generate-config-out=generated.tf`. + + ```hcl + import { + to = kinde_role.finance + id = "" + } + ``` + +3. Run `terraform plan` and adjust the configuration until it shows no changes. + +Resources that exist in the context of another resource use a composite ID separated by colons. Organizations are imported by their code. + +| Resource | Import ID | +| ------------------------------ | ---------------------------------- | +| `kinde_organization` | `` | +| `kinde_application_connection` | `:` | +| `kinde_organization_user` | `:` | +| `kinde_user_role` | `::` | + +## Manage multiple environments + +Kinde environments are isolated, and each one has its own domain and M2M application keys. Keep one Terraform state per environment and swap the credentials per run. + +- **Workspaces or separate root modules.** Use `terraform workspace` or one directory per environment, and pass environment-specific values with `.tfvars` files. +- **Provider aliases.** If you manage several environments from one configuration, declare one `provider "kinde"` block per environment with an `alias`, and select it on each resource with `provider = kinde.`. +- **CI secrets.** In CI, set the four `KINDE_*` environment variables from your secret store for the target environment. + +```yaml title=".github/workflows/kinde-terraform.yml" +name: Kinde Terraform +on: + workflow_dispatch: + inputs: + environment: + description: "Kinde environment to apply" + required: true + type: choice + options: [dev, staging, prod] + +jobs: + apply: + runs-on: ubuntu-latest + environment: ${{ inputs.environment }} + env: + KINDE_DOMAIN: ${{ secrets.KINDE_DOMAIN }} + KINDE_AUDIENCE: ${{ secrets.KINDE_AUDIENCE }} + KINDE_CLIENT_ID: ${{ secrets.KINDE_CLIENT_ID }} + KINDE_CLIENT_SECRET: ${{ secrets.KINDE_CLIENT_SECRET }} + steps: + - uses: actions/checkout@v4 + - uses: hashicorp/setup-terraform@v3 + - run: terraform init + - run: terraform plan -out=tfplan -var-file="${{ inputs.environment }}.tfvars" + - run: terraform apply tfplan +``` + +The `environment` input selects the matching GitHub environment, so its protection rules — such as required reviewers on `prod` — gate the job. Saving the plan with `-out` and applying that file means the apply executes exactly the plan that was produced, not a recomputed one. + +For how to create additional Kinde environments, see [Manage Kinde environments](/build/environments/environments/). + +## FAQs + +### What can't the provider manage yet? + +Environment variables, feature flags, API scopes, and business or environment settings are not covered in the current release. Use the [Management API seed script](/developer-tools/guides/manage-kinde-configuration/) for those, or open an issue on the [provider repository](https://github.com/kinde-oss/terraform-provider-kinde/issues) to request a resource. If you run the seed script alongside Terraform, keep Terraform as the only owner of applications, APIs, connections, organizations, users, roles, and permissions, and limit the seed script to the settings listed above — two owners for the same resource create duplicates and drift. + +### Which Terraform versions are supported? + +Terraform 1.0 and later. The provider uses Terraform plugin protocol 6. + +### Where is the full schema reference? + +On the [Terraform Registry](https://registry.terraform.io/providers/kinde-oss/kinde/latest/docs). The registry docs are generated from the provider code, so they always match the published version. + +### How do I report a bug or contribute? + +Open an issue or pull request on [GitHub](https://github.com/kinde-oss/terraform-provider-kinde). The provider is open source under the Mozilla Public License 2.0. + +If you need help getting Kinde connected, contact us at [support@kinde.com](mailto:support@kinde.com). diff --git a/src/content/docs/get-started/apis-and-sdks/about-kinde-apis.mdx b/src/content/docs/get-started/apis-and-sdks/about-kinde-apis.mdx index 7a4073954..945cb99e0 100644 --- a/src/content/docs/get-started/apis-and-sdks/about-kinde-apis.mdx +++ b/src/content/docs/get-started/apis-and-sdks/about-kinde-apis.mdx @@ -6,6 +6,7 @@ sidebar: description: Overview of Kinde APIs including Management API access via M2M applications and registering custom APIs for secure integration. relatedArticles: - 6bf993fc-a195-4836-8eaf-133812be8876 + - f6886655-e356-4abb-bf0a-6d69d9503178 - 51899f7f-3436-46e0-9a1b-6ecc3603a0df - 50284476-2442-414c-af20-01ed3ef4ca4e - 601dd8c5-6ee1-474f-ad36-201e65280462 @@ -27,10 +28,12 @@ keywords: - m2m applications - api registration - integration -updated: 2024-01-15 + - terraform provider + - infrastructure as code +updated: 2026-08-21 featured: false deprecated: false -ai_summary: Overview of Kinde APIs including Management API access via M2M applications and registering custom APIs for secure integration. +ai_summary: Overview of Kinde APIs including Management API access via M2M applications, managing Kinde configuration as code with the Kinde Terraform provider, and registering custom APIs for secure integration. --- At Kinde we want to empower founders to build their product their way, and integrate with us in a way that suits them. That’s why we’re building out the Kinde Management API and allowing Kinde users to register their API with us as well. @@ -42,3 +45,7 @@ You can only access Kinde's API via machine to machine (M2M) applications. Once ## Integrate by registering your own API If your product has its own APIs, you can register them with Kinde to ensure access requests to your endpoints are secure and authorized. See [Register an API](/developer-tools/your-apis/register-manage-apis/). + +## Manage Kinde configuration with Terraform + +If you manage infrastructure as code, the [Kinde Terraform provider](/developer-tools/guides/terraform-provider/) uses the Management API under the hood to manage applications, APIs, connections, organizations, users, roles, and permissions from HCL. diff --git a/src/data/sdkList.ts b/src/data/sdkList.ts index 5daec5ec2..0639133df 100644 --- a/src/data/sdkList.ts +++ b/src/data/sdkList.ts @@ -177,6 +177,13 @@ const sdkList: SDK[] = [ iconWidth: "28", type: "Back end" }, + { + name: "Terraform", + link: "/developer-tools/guides/terraform-provider/", + icon: "terraform", + iconWidth: "24", + type: "Back end" + }, { name: "Angular", link: "https://github.com/luukhaijes/kinde-angular", diff --git a/src/icons/terraform.svg b/src/icons/terraform.svg new file mode 100644 index 000000000..e98f8b71f --- /dev/null +++ b/src/icons/terraform.svg @@ -0,0 +1,7 @@ + + + + + + +