Context. The provider currently authenticates exclusively through the OAuth1 token/secret pair (CLEVER_TOKEN / CLEVER_SECRET). For CI/CD pipelines this has two practical drawbacks: two secrets to provision and rotate instead of one, and OAuth1 access tokens expire after ~3 months by default — which silently breaks scheduled pipelines (drift detection, gated applies) with no warning.
Clever Cloud now offers API tokens (clever tokens create, console UI) consumed as Authorization: Bearer against https://api-bridge.clever-cloud.com, with caller-chosen expiration and clean revocation — a much better fit for automation.
Proposal. Add an api_token provider attribute (environment variable CLEVER_API_TOKEN), mutually exclusive with token/secret:
provider "clevercloud" {
api_token = var.api_token # or CLEVER_API_TOKEN
}When set, the provider sends Authorization: Bearer requests to api-bridge.clever-cloud.com instead of OAuth1-signed requests to api.clever-cloud.com. Configuration validation fails with a clear message when both modes or neither are supplied.
Context. The provider currently authenticates exclusively through the OAuth1 token/secret pair (
CLEVER_TOKEN/CLEVER_SECRET). For CI/CD pipelines this has two practical drawbacks: two secrets to provision and rotate instead of one, and OAuth1 access tokens expire after ~3 months by default — which silently breaks scheduled pipelines (drift detection, gated applies) with no warning.Clever Cloud now offers API tokens (
clever tokens create, console UI) consumed asAuthorization: Beareragainsthttps://api-bridge.clever-cloud.com, with caller-chosen expiration and clean revocation — a much better fit for automation.Proposal. Add an
api_tokenprovider attribute (environment variableCLEVER_API_TOKEN), mutually exclusive withtoken/secret:When set, the provider sends
Authorization: Bearerrequests toapi-bridge.clever-cloud.cominstead of OAuth1-signed requests toapi.clever-cloud.com. Configuration validation fails with a clear message when both modes or neither are supplied.