---
page_title: "descope_management_key Resource - descope"
subcategory: ""
description: |-
  Manages a Descope Management Key used to authenticate API and SDK calls for automating user and project management.
---

# descope_management_key (Resource)

Manages a Descope Management Key—a credential used to authenticate programmatic access to the Descope Management API and SDKs. Management keys are used for backend operations such as creating users, managing sessions, and building automation pipelines.

~> **Important:** The `cleartext` attribute (the raw key value) is only available immediately after creation and **cannot be retrieved later** through the API. Store it securely using a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault) immediately after `terraform apply`.

Keys can be scoped to restrict which projects they can access, at the company level or per-project or tag:
- **Company roles** – Access to all projects in the company
- **Project roles** – Scoped to specific project IDs
- **Tag roles** – Scoped to all projects with a given tag

See the [Descope documentation](https://docs.descope.com) for the list of valid role names.

## Example Usage

### Company-Level Key

```hcl
resource "descope_management_key" "company_key" {
  name        = "CI/CD Pipeline Key"
  description = "Used by the deployment pipeline to manage users"

  rebac = {
    company_roles = ["<role-name>"]
  }
}

# Store the cleartext key in your secrets manager
output "management_key_value" {
  value     = descope_management_key.company_key.cleartext
  sensitive = true
}
```

### Project-Scoped Key with Expiration

```hcl
resource "descope_management_key" "project_key" {
  name        = "Staging Key"
  description = "Limited access to staging project only"

  # Expires 1 year from a fixed date (Unix timestamp)
  expire_time = 1893456000

  rebac = {
    project_roles = [
      {
        project_ids = ["<project-id>"]
        roles       = ["<role-name>"]
      }
    ]
  }
}
```

### Tag-Scoped Key with IP Restriction

```hcl
resource "descope_management_key" "restricted_key" {
  name = "Office Network Key"

  permitted_ips = ["203.0.113.0/24", "198.51.100.10"]

  rebac = {
    tag_roles = [
      {
        tags  = ["production"]
        roles = ["<role-name>"]
      }
    ]
  }
}
```


<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) A name for the management key.
- `rebac` (Attributes) Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced. (see [below for nested schema](#nestedatt--rebac))

### Optional

- `description` (String) A description for the management key.
- `expire_time` (Number) The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
- `permitted_ips` (List of String) A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
- `status` (String) The status of the management key. Must be either `active` or `inactive`.

### Read-Only

- `cleartext` (String, Sensitive) The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
- `id` (String) The ID of this resource.

<a id="nestedatt--rebac"></a>
### Nested Schema for `rebac`

Optional:

- `company_roles` (Set of String) A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with `tag_roles` and `project_roles`.
- `project_roles` (Attributes List) A list of project-level role names that are granted to the management key for specific projects by their project ID. (see [below for nested schema](#nestedatt--rebac--project_roles))
- `tag_roles` (Attributes List) A list of project-level role names that are granted to the management key for all projects that have a specific tag. (see [below for nested schema](#nestedatt--rebac--tag_roles))

<a id="nestedatt--rebac--project_roles"></a>
### Nested Schema for `rebac.project_roles`

Required:

- `project_ids` (Set of String) The project IDs this role grant applies to.
- `roles` (Set of String) The roles the management key will be granted in the applicable projects.


<a id="nestedatt--rebac--tag_roles"></a>
### Nested Schema for `rebac.tag_roles`

Required:

- `roles` (Set of String) The roles the management key will be granted in the applicable projects.
- `tags` (Set of String) The project tags this role grant applies to.