---
page_title: "ona_git_authentication Resource - ona"
subcategory: "Identity and Access"
description: |-
  PAT-backed Git authentication for an Ona service account through a PAT-enabled runner SCM integration.
---

# ona_git_authentication (Resource)

PAT-backed Git authentication for an Ona service account through a PAT-enabled runner SCM integration.

For product context, see [Service accounts](https://ona.com/docs/ona/organizations/service-accounts), [Configuring repository access](https://ona.com/docs/ona/runners/configuring-repository-access), and [Git providers](https://ona.com/docs/ona/source-control/overview).

**Prerequisite:** The target service account must be authorized for the selected runner before Terraform creates the Git authentication. The example adds the service account to a group, grants that group the `user` role on the same runner with `ona_runner_role_assignment`, and makes the Git authentication depend on both resources. The `user` role is sufficient. Permissions held only by the provider credential are insufficient because host-authentication lifecycle requests run as the target service account.

## Example Usage

```terraform
variable "github_service_account_pat" {
  description = "GitHub personal access token for the automation service account."
  type        = string
  sensitive   = true
  ephemeral   = true
}

resource "ona_group" "automation_executors" {
  name        = "Automation Executors"
  description = "Service accounts that run automations."
}

resource "ona_group_membership" "automation_executor" {
  group_id           = ona_group.automation_executors.id
  service_account_id = ona_service_account.automation.id
}

resource "ona_runner_role_assignment" "automation_executor" {
  runner_id = ona_scm_integration.github_pat.runner_id
  group_id  = ona_group.automation_executors.id
  role      = "user"
}

resource "ona_git_authentication" "automation" {
  service_account_id            = ona_service_account.automation.id
  scm_integration_id            = ona_scm_integration.github_pat.id
  personal_access_token         = var.github_service_account_pat
  personal_access_token_version = "2026-07-28"

  depends_on = [
    ona_group_membership.automation_executor,
    ona_runner_role_assignment.automation_executor,
  ]
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `scm_integration_id` (String) PAT-enabled SCM integration that determines the runner and host. Changing this value replaces the authentication.
- `service_account_id` (String) Service account that uses this Git authentication. Changing this value replaces the authentication.

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `personal_access_token` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) SCM personal access token. This write-only value is sent to Ona but is not stored in Terraform plan or state. Required on create and when changing `personal_access_token_version`.
- `personal_access_token_version` (String) User-managed version marker for resubmitting `personal_access_token` during rotation.

### Read-Only

- `expires_at` (String) RFC3339 timestamp when the PAT expires, when known.
- `host` (String) SCM host derived from the SCM integration.
- `id` (String) Git authentication ID.
- `runner_id` (String) Runner derived from the SCM integration.
- `scopes` (Set of String) Non-secret PAT scope metadata returned by Ona.

## Import

Import is supported using the following syntax:

The personal access token is not retrieved during import. Omit `personal_access_token` from imported resource configuration; supply it only when creating the authentication or rotating it with `personal_access_token_version`.

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
#!/usr/bin/env sh

terraform import ona_git_authentication.automation 01980ed3-a090-7b5b-a74c-9bf5d8cfe53c
```