---
page_title: "descope Provider"
description: |-
  Use the Descope Terraform Provider to manage your Descope project's authentication methods, flows, roles, permissions, connectors, and more as infrastructure-as-code.
---

# Descope Provider

The [Descope](https://www.descope.com) Terraform Provider lets you manage your Descope project configuration as infrastructure-as-code. Configure authentication methods, define roles and permissions, set up third-party connectors, manage flows, and more—all declaratively in Terraform.

Descope is an authentication and user management platform. The Terraform provider manages _project configuration_ (how your project behaves), not users or tenants (use the [Descope Management API](https://docs.descope.com/api/openapi) or [SDKs](https://docs.descope.com) for those).

## Requirements

- [Terraform](https://developer.hashicorp.com/terraform/install) 1.0 or later, or 1.5 or later to adopt an existing project
  with `import` blocks
- A Descope **Pro or Enterprise** plan
- A **Management Key** from [Company Settings](https://app.descope.com/settings/company) in the Descope console

## Authentication

The provider authenticates with the Descope API using a management key. You can create management keys in the [Company Settings](https://app.descope.com/settings/company) section of the Descope console.

~> **Security Note:** Never hardcode your management key in Terraform configuration files, as this risks exposing it in version control. Use environment variables or a secrets manager instead.

### Environment Variables

| Variable                | Description                                              |
|-------------------------|----------------------------------------------------------|
| `DESCOPE_MANAGEMENT_KEY` | A valid management key for your Descope company         |
| `DESCOPE_BASE_URL`       | Override the Descope API base URL (optional, for testing) |

```shell
export DESCOPE_MANAGEMENT_KEY="K2..."
terraform plan
```

## Example Usage

### Minimal Configuration

```hcl
terraform {
  required_providers {
    descope = {
      source  = "descope/descope"
      version = "~> 1.0"
    }
  }
}

# Credentials are read from the DESCOPE_MANAGEMENT_KEY environment variable
provider "descope" {}
```

### Creating a Project

```hcl
resource "descope_project" "example" {
  name        = "my-app"
  environment = "production"
  tags        = ["prod"]
}
```

### Full Provider Configuration

If you need to explicitly configure the provider (e.g. in a module or when not using environment variables):

```hcl
terraform {
  required_providers {
    descope = {
      source  = "descope/descope"
      version = "~> 1.0"
    }
  }
}

variable "descope_management_key" {
  type      = string
  sensitive = true
}

provider "descope" {
  management_key = var.descope_management_key
}
```

## Resources

`descope_project` manages the project itself: its name, environment, tags and deletion protection. Everything inside
the project is managed by its own resource, which references the project with a `project_id` attribute.

| Area | Resources |
|------|-----------|
| Project | [`descope_project`](resources/project), [`descope_project_settings`](resources/project_settings), [`descope_session_settings`](resources/session_settings), [`descope_session_migration`](resources/session_migration), [`descope_invite_settings`](resources/invite_settings), [`descope_admin_portal`](resources/admin_portal) |
| Authentication methods | [`descope_password_settings`](resources/password_settings), [`descope_otp_settings`](resources/otp_settings), [`descope_magiclink_settings`](resources/magiclink_settings), [`descope_enchantedlink_settings`](resources/enchantedlink_settings), [`descope_embeddedlink_settings`](resources/embeddedlink_settings), [`descope_passkey_settings`](resources/passkey_settings), [`descope_totp_settings`](resources/totp_settings), [`descope_sso_settings`](resources/sso_settings), [`descope_oauth_settings`](resources/oauth_settings), [`descope_oauth_provider`](resources/oauth_provider) |
| Messaging | [`descope_email_template`](resources/email_template), [`descope_text_template`](resources/text_template), [`descope_voice_template`](resources/voice_template) |
| Authorization | [`descope_role`](resources/role), [`descope_permission`](resources/permission), [`descope_fga_schema`](resources/fga_schema) |
| Attributes | [`descope_user_attribute`](resources/user_attribute), [`descope_tenant_attribute`](resources/tenant_attribute), [`descope_access_key_attribute`](resources/access_key_attribute) |
| Applications | [`descope_oidc_app`](resources/oidc_app), [`descope_saml_app`](resources/saml_app), [`descope_wsfed_app`](resources/wsfed_app), [`descope_inbound_app`](resources/inbound_app), [`descope_outbound_app`](resources/outbound_app), [`descope_app_role`](resources/app_role), [`descope_app_permission`](resources/app_permission) |
| Flows and styles | [`descope_flow`](resources/flow), [`descope_widget`](resources/widget), [`descope_styles`](resources/styles) |
| Access keys, tokens and lists | [`descope_access_key`](resources/access_key), [`descope_jwt_template`](resources/jwt_template), [`descope_list`](resources/list) |
| Connectors | One resource per connector type, named after it, e.g. [`descope_http_connector`](resources/http_connector) or [`descope_sendgrid_connector`](resources/sendgrid_connector), and [`descope_engine`](resources/engine) to run connector actions inside your own network |
| Company | [`descope_management_key`](resources/management_key), [`descope_descoper`](resources/descoper) |

## Guides

- [Quickstart](guides/quickstart) - Set up the provider and manage your first project
- [Upgrading from v0.3.x](guides/upgrading-from-v0.3) - Adopt a project managed by v0.3.x into the standalone resources

<!-- schema generated by tfplugindocs -->
## Schema

### Optional

- `base_url` (String) An optional base URL for the Descope API
- `management_key` (String, Sensitive) A valid management key for your Descope company
- `project_id` (String, Deprecated)