# Terraform Provider reference

Resources and data sources available through the Terraform Provider

The Terraform Provider provides access to [resources](https://developer.hashicorp.com/terraform/language/resources) and [data sources](https://developer.hashicorp.com/terraform/language/data-sources). Resources are infrastructure objects, such as a Supabase project, that you can declaratively configure. Data sources are sources of information about your Supabase instances.

## Provider settings

| Attribute | Description | Type | Optional | Sensitive |
| --- | --- | --- | --- | --- |
| `access_token` | Supabase access token. Can also be set via the `SUPABASE_ACCESS_TOKEN` environment variable. When both are specified, the provider configuration takes precedence over the environment variable. Generate a token from the [Supabase Dashboard](/dashboard/account/tokens). | string | true | true |
| `endpoint` | Supabase API endpoint. Can also be set via the `SUPABASE_API_ENDPOINT` environment variable. If neither is set, defaults to `https://api.supabase.com`. When both are specified, the provider configuration takes precedence over the environment variable. | string | true |  |

## Resources

### supabase_apikey

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `api_key` | API key | string |  |  |
| `description` | Description of the API key | string |  | true |
| `id` | API key identifier | string |  |  |
| `name` | Name of the API key | string | true |  |
| `project_ref` | Project reference ID | string | true |  |
| `secret_jwt_template` | Secret JWT template |  |  |  |
| `type` | Type of the API key | string |  |  |

### supabase_branch

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `database` | Database connection details |  |  |  |
| `git_branch` | Git branch | string | true |  |
| `id` | Branch identifier | string |  |  |
| `parent_project_ref` | Parent project ref | string | true |  |
| `persistent` | Branch persistency | bool |  | true |
| `region` | Database region | string |  | true |

### supabase_edge_function

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `checksum` | SHA256 checksum of the deployed function bundle (remote) | string |  |  |
| `created_at` | Timestamp when the function was created | number |  |  |
| `entrypoint` | Path to the function entrypoint file | string | true |  |
| `id` | Function identifier | string |  |  |
| `import_map` | Path to the import map file | string |  | true |
| `local_checksum` | SHA256 checksum of local source files before upload | string |  |  |
| `name` | Name of the function (defaults to slug if not specified) | string |  | true |
| `project_ref` | Project ref | string | true |  |
| `slug` | URL-friendly identifier for the function | string | true |  |
| `static_files` | List of glob patterns for static files to include | list,string |  | true |
| `status` | Function deployment status | string |  |  |
| `updated_at` | Timestamp when the function was last updated | number |  |  |
| `version` | Currently deployed function version | number |  |  |

### supabase_edge_function_secrets

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `id` | Project identifier | string |  |  |
| `project_ref` | Project reference ID | string | true |  |
| `secret_digests` | Map of secret name to the SHA-256 hex digest of the secret value. Computed by the provider at plan time (when plaintext values are known) and updated after each apply. Used to detect drift when a secret has been changed outside of Terraform: if the digest returned by the API no longer matches the locally computed digest, the provider marks the affected secret value as null so Terraform will plan an update. | map,string |  |  |
| `secrets` | Set of secrets for edge functions |  | true |  |

### supabase_project

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `database_password` | Password for the project database | string | true |  |
| `id` | Project identifier | string |  |  |
| `instance_size` | Desired instance size of the project | string |  | true |
| `legacy_api_keys_enabled` | Controls whether `anon` and `service_role` JWT-based api keys should be enabled. Please note: these keys are no longer recommended ([more information here](/docs/guides/api/api-keys#why-are-anon-and-servicerole-jwt-based-keys-no-longer-recommended)). | bool |  | true |
| `name` | Name of the project | string | true |  |
| `organization_id` | Organization slug (found in the Supabase dashboard URL or organization settings) | string | true |  |
| `region` | Region where the project is located | string | true |  |

### supabase_settings

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `api` | API settings as [serialised JSON](https://api.supabase.com/api/v1#/services/updatePostgRESTConfig) | string |  | true |
| `auth` | Auth settings as [serialised JSON](https://api.supabase.com/api/v1#/projects%20config/updateV1AuthConfig).

~> Several fields are returned as a hash by the API rather than plaintext. The provider preserves these fields from prior state, so out-of-band changes will not appear in `terraform plan`.

Affected fields: `smtp_pass`, `sms_twilio_auth_token`, `sms_twilio_verify_auth_token`, `sms_messagebird_access_key`, `sms_textlocal_api_key`, `sms_vonage_api_secret`, `security_captcha_secret`, `external_apple_secret`, `external_azure_secret`, `external_bitbucket_secret`, `external_discord_secret`, `external_facebook_secret`, `external_figma_secret`, `external_github_secret`, `external_gitlab_secret`, `external_google_secret`, `external_kakao_secret`, `external_keycloak_secret`, `external_linkedin_oidc_secret`, `external_notion_secret`, `external_slack_oidc_secret`, `external_slack_secret`, `external_spotify_secret`, `external_twitch_secret`, `external_twitter_secret`, `external_workos_secret`, `external_x_secret`, `external_zoom_secret`, `hook_custom_access_token_secrets`, `hook_mfa_verification_attempt_secrets`, `hook_password_verification_attempt_secrets`, `hook_send_email_secrets`, `hook_send_sms_secrets`. | string |  | true |
| `database` | Database settings as [serialised JSON](https://api.supabase.com/api/v1#/projects%20config/updateConfig) | string |  | true |
| `id` | Project identifier | string |  |  |
| `network` | Network settings as serialised JSON | string |  | true |
| `pooler` | Pooler settings as serialised JSON | string |  | true |
| `project_ref` | Project reference ID | string | true |  |
| `ssl_enforcement` | Enforce SSL on all database connections. See the [SSL enforcement API](https://api.supabase.com/api/v1#tag/database/put/v1/projects/%7Bref%7D/ssl-enforcement). | bool |  | true |
| `storage` | Storage settings as serialised JSON | string |  | true |

### supabase_third_party_auth

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `custom_jwks` | Custom public JWKS as serialised JSON. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured. This field follows Terraform provider industry practice for public verification keys and is not marked sensitive; do not include private or symmetric JWK material. | string |  | true |
| `id` | Third-party auth integration identifier | string |  |  |
| `inserted_at` | Timestamp when the integration was created | string |  |  |
| `jwks_url` | JWKS URL. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured. | string |  | true |
| `oidc_issuer_url` | OIDC issuer URL. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured. | string |  | true |
| `project_ref` | Project reference ID | string | true |  |
| `resolved_at` | Timestamp when JWKS was last resolved | string |  |  |
| `resolved_jwks` | Resolved JWKS as serialised JSON | string |  |  |
| `type` | Third-party auth integration type | string |  |  |
| `updated_at` | Timestamp when the integration was last updated | string |  |  |

## Data sources

### supabase_apikeys

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `anon_key` | Anonymous API key for the project | string |  |  |
| `project_ref` | Project reference ID | string | true |  |
| `publishable_key` | Publishable API key for the project | string |  |  |
| `secret_keys` | List of secret API keys for the project |  |  |  |
| `service_role_key` | Service role API key for the project | string |  |  |

### supabase_branch

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `branches` | Branch databases |  |  |  |
| `parent_project_ref` | Parent project ref | string | true |  |

### supabase_network_bans

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `banned_ipv4_addresses` | List of banned IPv4 addresses | set,string |  |  |
| `project_ref` | Project reference ID | string | true |  |

### supabase_pooler

| Attribute | Description | Type | Required | Optional |
| --- | --- | --- | --- | --- |
| `project_ref` | Project ref | string | true |  |
| `url` | Map of pooler mode to connection string | map,string |  |  |