Terraform

The vallkeyhq/vallkey Terraform provider manages ghost keys with an API token (Admin access) in VALLKEY_TOKEN.

1terraform {2  required_providers {3    vallkey = { source = "vallkeyhq/vallkey" }4  }5}67resource "vallkey_key" "chat" {8  service  = "openai"9  real_key = var.openai_key10  label    = "Chat backend"11  rules = jsonencode({12    allow         = [{ method = "POST", path = "/v1/chat/completions" }]13    ratePerMinute = 12014  })15}1617output "ghost_key" {18  value     = vallkey_key.chat.ghost_key19  sensitive = true20}

• The safety rules stay: looser rules and a new real key wait out the safety hour, or a second admin. Terraform finishes and says when they apply.
• Rules changed in the dashboard show up as a difference on the next plan.
• Custom APIs take custom = jsonencode({ origin, auth }); existing keys can be imported with terraform import vallkey_key.name <key id>.
• Terraform keeps the real key in its state: keep state in a backend that encrypts it.