litellm/terraform/provider/docs/data-sources/credential.md
Yassin Kortam ce2582e9d0
feat(terraform): vendor terraform-provider-litellm as source of truth with endpoint drift CI (#32241)
* feat(terraform): vendor terraform-provider-litellm as source of truth with endpoint drift CI

* fix(terraform): address review feedback on vendored provider

Replace deprecated io/ioutil with io. Remove the unused org/team CRUD
client methods so the endpoint audit only tracks live call sites
(54 -> 46). Redact request/response logs by parsing the JSON and
recursively masking sensitive fields, which fixes the nested-object
leak in the old credential_values regex, with a regex fallback for
non-JSON payloads; covered by new unit tests. Docs: stop showing
api_key inside vector store litellm_params and document that Sensitive
attributes still persist in plaintext state, recommending
litellm_credential_name and an encrypted state backend.

* fix(terraform): stop persisting server-returned litellm_params into vector store state

The vector store Read wrote litellm_params straight back from the API
response into state. The proxy redacts secrets in those responses, so
the readback overwrote user config with redaction sentinels and caused
perpetual diffs, and against a server that returns raw values it would
persist secrets into a non-Sensitive attribute. Read now preserves the
config value like the credential and model resources do, litellm_params
is marked Sensitive, and a regression test pins that a server-returned
api_key never lands in state

* fix(terraform): send role on team member update and stop persisting server env into MCP state

The team member update payload omitted role, and the proxy leaves role
unchanged when the field is absent, so a role downgrade reported as
applied by Terraform never took effect on the proxy. The update now
always sends the configured role (the attribute is Required).

The MCP server resource wrote env straight back from API responses
into a non-Sensitive attribute, pulling admin-visible secrets into
state and, for sanitized responses, blanking user config. Read now
preserves the config value, env is marked Sensitive, and the docs warn
against passing secrets via args. Regression tests cover both fixes
and fail against the previous behavior.
2026-07-07 09:16:59 -07:00

4.7 KiB

page_title subcategory description
litellm_credential Data Source - terraform-provider-litellm Retrieves information about an existing LiteLLM credential.

litellm_credential (Data Source)

Retrieves information about an existing LiteLLM credential. This data source allows you to reference credentials that were created outside of Terraform or in other Terraform configurations.

Example Usage

# Retrieve an existing credential by name
data "litellm_credential" "existing_openai" {
  credential_name = "openai-production-key"
}

# Use the credential in a model resource
resource "litellm_model" "gpt4_with_existing_cred" {
  model_name          = "gpt-4-with-existing-cred"
  custom_llm_provider = "openai"
  base_model          = "gpt-4"
  tier                = "paid"
  mode                = "chat"
  
  # Reference the existing credential's info
  additional_litellm_params = {
    credential_name = data.litellm_credential.existing_openai.credential_name
  }
}

Example Usage with Model ID

# Retrieve a credential associated with a specific model
data "litellm_credential" "model_specific_cred" {
  credential_name = "claude-api-key"
  model_id        = "claude-3-sonnet"
}

# Use in a vector store
resource "litellm_vector_store" "knowledge_base" {
  vector_store_name       = "claude-knowledge-base"
  custom_llm_provider     = "anthropic"
  litellm_credential_name = data.litellm_credential.model_specific_cred.credential_name
  
  vector_store_description = "Knowledge base using Claude credentials"
}

Example Usage for Cross-Reference

# Get credential info to use in other resources
data "litellm_credential" "shared_cred" {
  credential_name = "shared-api-key"
}

# Create multiple resources using the same credential
resource "litellm_vector_store" "store_1" {
  vector_store_name       = "store-1"
  custom_llm_provider     = "pinecone"
  litellm_credential_name = data.litellm_credential.shared_cred.credential_name
  
  vector_store_description = "First store using shared credential"
}

resource "litellm_vector_store" "store_2" {
  vector_store_name       = "store-2"
  custom_llm_provider     = "pinecone"
  litellm_credential_name = data.litellm_credential.shared_cred.credential_name
  
  vector_store_description = "Second store using shared credential"
}

Argument Reference

The following arguments are supported:

  • credential_name - (Required) Name of the credential to retrieve.
  • model_id - (Optional) Model ID associated with this credential. Use this when the same credential name is used for different models.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

  • credential_info - Map of additional non-sensitive information about the credential.

Security Note

For security reasons, the credential_values (sensitive data like API keys) are not exposed through data sources. This prevents accidental exposure of sensitive information in Terraform plans and logs. If you need to access credential values, you should manage them through the resource directly or use external secret management systems.

Common Use Cases

1. Cross-Stack References

Use data sources to reference credentials created in other Terraform configurations or stacks:

data "litellm_credential" "shared_openai" {
  credential_name = "openai-shared-key"
}

resource "litellm_model" "gpt4" {
  model_name          = "gpt-4-cross-stack"
  custom_llm_provider = "openai"
  base_model          = "gpt-4"
  
  additional_litellm_params = {
    credential_reference = data.litellm_credential.shared_openai.credential_name
  }
}

2. Conditional Logic

Use credential information for conditional resource creation:

data "litellm_credential" "optional_cred" {
  credential_name = var.credential_name
}

resource "litellm_vector_store" "conditional_store" {
  count = length(data.litellm_credential.optional_cred.credential_info) > 0 ? 1 : 0
  
  vector_store_name       = "conditional-store"
  custom_llm_provider     = "weaviate"
  litellm_credential_name = data.litellm_credential.optional_cred.credential_name
}

3. Validation and Verification

Verify that required credentials exist before creating dependent resources:

data "litellm_credential" "required_cred" {
  credential_name = "production-api-key"
}

# This will fail if the credential doesn't exist
resource "litellm_model" "production_model" {
  model_name          = "production-gpt-4"
  custom_llm_provider = "openai"
  base_model          = "gpt-4"
  
  additional_litellm_params = {
    credential_name = data.litellm_credential.required_cred.credential_name
  }
}