Workspace keys with the Terraform provider

Use interfere_public_key to manage a public workspace or App key. The surface_slug attribute is optional: omitting it or setting it to null creates a workspace key. Setting an App slug creates a deprecated App-scoped key, which remains supported.

A workspace already has a Default key. Import that key if you want Terraform to manage it, or create an additional key for a separate lifecycle. One workspace key can serve all its Apps; use stable SDK service names to select the destination, as described in Workspace keys.

Create a workspace key

With your Interfere provider configured:

1resource "interfere_public_key" "browser" {2  workspace_slug = "example"3  name           = "Browser"4}56output "interfere_public_key" {7  value = interfere_public_key.browser.content8}

Adding surface_slug = null is equivalent to omitting it. Feed content into INTERFERE_PUBLIC_KEY for Next.js or VITE_INTERFERE_PUBLIC_KEY for Vite. Both accept a public workspace or App key. Keep the build secret separate and server-side.

Creation and revocation of workspace keys require org:workspace_auth:write; refresh and import require org:workspace_auth:read or org:surfaces:read.

Import an existing key

Workspace keys use a two-part import ID:

1terraform import interfere_public_key.browser example/11111111-1111-4111-8111-111111111111

Existing App keys retain their three-part import ID:

1terraform import interfere_public_key.browser example/storefront/11111111-1111-4111-8111-111111111111

For an App-key import, set surface_slug = "storefront" in the resource configuration. Changing between workspace and App scope replaces the key; it does not rescope the existing credential in place. Plan deployment updates before applying that replacement.

List and rotate keys

The interfere_public_keys data source follows the same optional surface_slug rule: omitted or null lists workspace keys, while an App slug lists that App’s keys.

1data "interfere_public_keys" "workspace" {2  workspace_slug = "example"3}

External rotation refreshes the resource’s content. Update deployments that consume it before the old value’s grace period ends. Destroying the resource revokes its key; revoking a shared workspace key affects every App still using it.

For dashboard setup and build credentials, see Onboarding with workspace keys.