> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage env zero with the Terraform provider

> Configure the env zero Terraform provider to manage projects, templates, environments, variables, and agents as code with Terraform or OpenTofu.

The env zero Terraform provider (`env0/env0`) manages env zero itself as code: projects, templates, environments, variables, credentials, agents, and policies. It works with Terraform and OpenTofu. For every resource and data source, see the [Terraform Registry](https://registry.terraform.io/providers/env0/env0/latest/docs) or the [OpenTofu Registry](https://search.opentofu.org/provider/env0/env0/latest).

## Prerequisites

* Terraform or OpenTofu installed.
* An env zero [API key](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/api-keys.md) ID and secret.

> [!WARNING]
>
> The key's role decides what the provider can manage. For example, a [read-only key](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/api-keys.md#read-only-api-key) can read but not create.

## Configure the provider

```hcl main.tf theme={null}
terraform {
  required_providers {
    env0 = {
      source  = "env0/env0"
      version = "~> 1.35"
    }
  }
}

provider "env0" {}
```

Check the registry for the latest release.

Set the API key in environment variables instead of the provider block, so it stays out of your code:

```bash theme={null}
export ENV0_API_KEY=<YOUR_API_KEY_ID>
export ENV0_API_SECRET=<YOUR_API_KEY_SECRET>
```

| Argument | Environment variable | Default | Description |
| - | - | - | - |
| `api_key` | `ENV0_API_KEY` | none | API key ID. Required. |
| `api_secret` | `ENV0_API_SECRET` | none | API key secret. Required. |
| `organization_id` | `ENV0_ORGANIZATION_ID` | none | Required when the API key belongs to more than one organization. Ignored otherwise. |
| `api_endpoint` | `ENV0_API_ENDPOINT` | `https://api.env0.com/` | env zero API URL. Usually set only for testing. |

To run the provider from an env zero environment, set `ENV0_API_KEY` and `ENV0_API_SECRET` as sensitive environment variables on the environment or its project. See [Secrets](https://docs.envzero.com/guides/admin-guide/variables.md#secrets). env zero sets `ENV0_ORGANIZATION_ID` in every deployment, so the provider uses the environment's organization.

## Rate limits

Each provider process keeps its own request rate under the [API rate limits](https://docs.envzero.com/guides/community-and-resources/support-and-help/api-access.md#rate-limits). The API counts requests per source IP, so parallel runs from one IP share the limit and can exceed it together. If the API still returns `429 Too Many Requests`, the provider pauses requests to that method and path, then retries with an increasing wait. It retries a request up to 10 times, so a large plan runs slower instead of failing on the first `429`.

## Common tasks

| Task | Guide |
| - | - |
| Install a self-hosted agent | [Install the agent with Terraform](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/terraform-bootstrap.md) |
| Use v2 OIDC tokens on a credential | [Token versions](https://docs.envzero.com/guides/integrations/oidc-integrations.md#token-versions-v2-per-provider-audience-and-v1-legacy) |
| Lock a variable set's variable for lower scopes | [Variable sets](https://docs.envzero.com/guides/admin-guide/variables/variable-sets.md#precedence-and-conflicts) |
| Reference a VCS connection in a template | [Look up a connection in Terraform](https://docs.envzero.com/guides/admin-guide/manage-vcs.md#look-up-a-connection-in-terraform) |
| Configure workflow sub-environments | [Terraform provider settings for sub-environments](https://docs.envzero.com/guides/admin-guide/workflows/terraform-provider-sub-environment-settings.md) |
| Pin deployments to an approved revision | [Pin deployments to an approved revision](https://docs.envzero.com/guides/policies-governance/pin-deployments-to-an-approved-revision.md) |
| Allowlist env zero IP addresses | [IP addresses](https://docs.envzero.com/guides/overview/security-overview/ip-addresses.md) |

## Next steps

* [API keys](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/api-keys.md) - Create the key the provider uses.
* [API access](https://docs.envzero.com/guides/community-and-resources/support-and-help/api-access.md) - Call the env zero API directly.
* [env zero CLI](https://docs.envzero.com/guides/community-and-resources/support-and-help/env-zero-cli.md) - Manage environments from the terminal.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.