feat: add expire_at to doppler_service_token

docs/resources/service_token.md

@@ -34,6 +34,7 @@ resource "doppler_service_token" "backend_ci_token" {
 ### Optional
 
 - `access` (String) The access level (read or read/write)
+- `expire_at` (String) The expiration time of the token as an RFC3339 timestamp (e.g. `2026-12-31T23:59:59Z`). If omitted, the token never expires.
 
 ### Read-Only
 

doppler/api.go

@@ -1177,13 +1177,16 @@ func (client APIClient) GetServiceTokens(ctx context.Context, project string, co
 	return result.ServiceTokens, nil
 }
 
-func (client APIClient) CreateServiceToken(ctx context.Context, project string, config string, access string, name string) (*ServiceToken, error) {
+func (client APIClient) CreateServiceToken(ctx context.Context, project string, config string, access string, name string, expireAt string) (*ServiceToken, error) {
 	payload := map[string]interface{}{
 		"project": project,
 		"config":  config,
 		"access":  access,
 		"name":    name,
 	}
+	if expireAt != "" {
+		payload["expire_at"] = expireAt
+	}
 	body, err := json.Marshal(payload)
 	if err != nil {
 		return nil, &APIError{Err: err, Message: "Unable to serialize service token"}

doppler/models.go

@@ -274,6 +274,7 @@ type ServiceToken struct {
 	Access      string `json:"access"`
 	Key         string `json:"key"`
 	CreatedAt   string `json:"created_at"`
+	ExpiresAt   string `json:"expires_at,omitempty"`
 }
 
 type ServiceTokenResponse struct {

doppler/resource_service_token.go

@@ -42,6 +42,13 @@ func resourceServiceToken() *schema.Resource {
 				ValidateFunc: validation.StringInSlice([]string{"read", "read/write"}, false),
 				ForceNew:     true,
 			},
+			"expire_at": {
+				Description:  "The expiration time of the token as an RFC3339 timestamp (e.g. `2026-12-31T23:59:59Z`). If omitted, the token never expires.",
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.IsRFC3339Time,
+			},
 			"key": {
 				Description: "The key for the Doppler service token",
 				Type:        schema.TypeString,
@@ -60,8 +67,9 @@ func resourceServiceTokenCreate(ctx context.Context, d *schema.ResourceData, m i
 	config := d.Get("config").(string)
 	access := d.Get("access").(string)
 	name := d.Get("name").(string)
+	expireAt := d.Get("expire_at").(string)
 
-	token, err := client.CreateServiceToken(ctx, project, config, access, name)
+	token, err := client.CreateServiceToken(ctx, project, config, access, name, expireAt)
 	if err != nil {
 		return diag.FromErr(err)
 	}