# dokploy_api_key (Resource)

An API key of the user that the provider authenticates as, for example a key that a CI pipeline or a second Terraform configuration uses. Dokploy returns the key once, at creation; the resource keeps it in the state as a sensitive value.

~> **Every attribute replaces the key on change.** Dokploy has no update endpoint for API keys. A replaced key is a new secret: rotate it where the old one is in use.

~> **`rate_limit_enabled` defaults to `false` here, not to the Dokploy default.** A raw `user.createApiKey` call enables a budget of 10 requests per 24 hours, which starves any automation; the Get started guide explains the two key shapes.

~> `terraform import` is not possible: Dokploy never returns the key again.

## Example Usage

```terraform
# A key for a CI pipeline. Dokploy returns the key once; Terraform keeps it
# in the state as a sensitive value. Every attribute replaces the key on
# change, so a rename is a rotation.
resource "dokploy_api_key" "ci" {
  name   = "github-actions"
  prefix = "ci"
}

# Hand the key to the pipeline through an output or a secret store.
output "ci_api_key" {
  value     = dokploy_api_key.ci.key
  sensitive = true
}

# A key that expires after 30 days and allows 600 requests per minute.
resource "dokploy_api_key" "review" {
  name                   = "review-bot"
  expires_in             = 30 * 24 * 60 * 60
  rate_limit_enabled     = true
  rate_limit_max         = 600
  rate_limit_time_window = 60 * 1000
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) Display name.

### Optional

- `expires_in` (Number) Lifetime in seconds, at least `86400` (one day). Omit it for a key that never expires.
- `prefix` (String) Prefix that the generated key starts with, for example `ci`. It helps to identify the key in logs.
- `rate_limit_enabled` (Boolean) Limit the requests per time window. Defaults to `false`.
- `rate_limit_max` (Number) Requests allowed per time window, when `rate_limit_enabled` is `true`.
- `rate_limit_time_window` (Number) Length of the rate-limit window in milliseconds, when `rate_limit_enabled` is `true`.

### Read-Only

- `created_at` (String) Creation timestamp from the server.
- `expires_at` (String) Expiry timestamp from the server, or null for a key that never expires.
- `id` (String) Key id.
- `key` (String, Sensitive) The API key. Dokploy returns it once, at creation.