---
page_title: "ona_runner_token Resource - ona"
subcategory: "Runners"
description: |-
  Creates an Ona runner registration token and stores it in Terraform state. The token expires after 24 hours and can only be used once. Terraform does not rotate it automatically; change token_version deliberately when consumers need a new token. The token is sensitive, which redacts it from normal CLI output but does not remove it from state. Use an encrypted, access-controlled remote state backend.
---

# ona_runner_token (Resource)

Creates an Ona runner registration token and stores it in Terraform state. The token expires after 24 hours and can only be used once. Terraform does not rotate it automatically; change `token_version` deliberately when consumers need a new token. The token is sensitive, which redacts it from normal CLI output but does not remove it from state. Use an encrypted, access-controlled remote state backend.

For product context, see [Runner infrastructure](https://ona.com/docs/ona/runners/overview). Downstream consumers are responsible for their one-time consumption lifecycle. The registration token is valid for 24 hours and can only be used once.

## Example Usage

```terraform
resource "ona_runner_token" "bootstrap" {
  runner_id     = ona_runner.example.runner_id
  token_version = "v1"
}

module "runner_bootstrap" {
  source = "./modules/runner-bootstrap"

  runner_token = ona_runner_token.bootstrap.token
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `runner_id` (String) Runner ID for which to create a registration exchange token. Changing this value replaces the resource and mints a new token.

### Optional

- `token_version` (String) User-managed rotation marker. Changing this value replaces the resource and mints a new runner registration token. Ona does not rotate the token automatically when its 24-hour lifetime expires.

### Read-Only

- `id` (String) Stable local Terraform resource ID. Ona does not expose a durable token object ID.
- `token` (String, Sensitive) Runner registration exchange token. This sensitive value is redacted from normal Terraform output but persists in Terraform state so ordinary resources and module inputs can consume it. It expires after 24 hours and can only be used once. Store state in an encrypted, access-controlled remote backend.