Authentication

The provider authenticates to the Webhookr API in one of two mutually exclusive ways:

1. API token (recommended) — a whk_… token created in the dashboard.
2. Firebase service account — for environments that already use Firebase credentials.

Provide one of them. Supplying both raises a Conflicting authentication error.

Provider configuration

Every option can be set in the provider block or via an environment variable.

Argument	Environment variable	Purpose
api_url	WEBHOOKR_API_URL	Webhookr API base URL, e.g. https://api.webhookr.tech. Required.
api_token	WEBHOOKR_API_TOKEN	API token (whk_…). Mutually exclusive with Firebase.
firebase_api_key	WEBHOOKR_FIREBASE_API_KEY	Firebase Web API key.
service_account_email	WEBHOOKR_SERVICE_ACCOUNT_EMAIL	Service account email (name@project.iam.gserviceaccount.com).
service_account_key	WEBHOOKR_SERVICE_ACCOUNT_KEY	Service account RSA private key (PEM).

See Terraform environment variables for the full reference.

Option 1 — API token (recommended)

Create a token in the dashboard under Settings → API tokens (see API Tokens), then expose it as an environment variable:

export WEBHOOKR_API_URL="https://api.webhookr.tech"
export WEBHOOKR_API_TOKEN="whk_xxxxxxxxxxxxxxxxxxxxxxxx"

provider "webhookr" {
  api_url = "https://api.webhookr.tech"
  # api_token is read from WEBHOOKR_API_TOKEN
}

You can set api_token directly in the block, but prefer the environment variable so the secret never lands in your configuration or state.

:::tip Why API tokens API tokens are the simplest option for CI/CD and machine-to-machine automation — no Firebase setup, just one secret. Create one token per pipeline so you can revoke it independently. :::

Option 2 — Firebase service account

When api_token is absent, the provider falls back to Firebase credentials:

export WEBHOOKR_API_URL="https://api.webhookr.tech"
export WEBHOOKR_FIREBASE_API_KEY="AIza..."
export WEBHOOKR_SERVICE_ACCOUNT_EMAIL="ci@your-project.iam.gserviceaccount.com"
export WEBHOOKR_SERVICE_ACCOUNT_KEY="$(cat service-account-key.pem)"

provider "webhookr" {
  api_url = "https://api.webhookr.tech"
  # firebase_* values read from the environment
}

All three Firebase values are required together. The provider exchanges the service account credentials for an ID token to authenticate API calls.

note

Firebase environment variables are only consulted when api_token is not set. This avoids a false Conflicting authentication error in environments where WEBHOOKR_FIREBASE_* and WEBHOOKR_API_TOKEN are both exported — the API token wins.

Troubleshooting

If authentication fails, check Troubleshooting → Terraform authentication failed.