Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Descope Provider
  4. API Docs
  5. AccessKey
Viewing docs for Descope v0.3.13
published on Tuesday, Jul 14, 2026 by Descope
Schema (JSON)
descope/pulumi-descope

descope.AccessKey

descope logo
Viewing docs for Descope v0.3.13
published on Tuesday, Jul 14, 2026 by Descope
Schema (JSON)
descope/pulumi-descope

    Create AccessKey Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AccessKey(name: string, args: AccessKeyArgs, opts?: CustomResourceOptions);
    @overload
def AccessKey(resource_name: str,
              args: AccessKeyArgs,
              opts: Optional[ResourceOptions] = None)

@overload
def AccessKey(resource_name: str,
              opts: Optional[ResourceOptions] = None,
              project_id: Optional[str] = None,
              bound_user_id: Optional[str] = None,
              custom_attributes: Optional[str] = None,
              custom_claims: Optional[str] = None,
              description: Optional[str] = None,
              expire_time: Optional[int] = None,
              name: Optional[str] = None,
              permitted_ips: Optional[Sequence[str]] = None,
              roles: Optional[Sequence[str]] = None,
              status: Optional[str] = None,
              tenants: Optional[Sequence[AccessKeyTenantArgs]] = None)
    func NewAccessKey(ctx *Context, name string, args AccessKeyArgs, opts ...ResourceOption) (*AccessKey, error)
    public AccessKey(string name, AccessKeyArgs args, CustomResourceOptions? opts = null)
    public AccessKey(String name, AccessKeyArgs args)
public AccessKey(String name, AccessKeyArgs args, CustomResourceOptions options)

    type: descope:AccessKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "descope_access_key" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AccessKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AccessKeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AccessKeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AccessKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AccessKeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var accessKeyResource = new Descope.AccessKey("accessKeyResource", new()
{
    ProjectId = "string",
    BoundUserId = "string",
    CustomAttributes = "string",
    CustomClaims = "string",
    Description = "string",
    ExpireTime = 0,
    Name = "string",
    PermittedIps = new[]
    {
        "string",
    },
    Roles = new[]
    {
        "string",
    },
    Status = "string",
    Tenants = new[]
    {
        new Descope.Inputs.AccessKeyTenantArgs
        {
            TenantId = "string",
            Roles = new[]
            {
                "string",
            },
        },
    },
});

    example, err := descope.NewAccessKey(ctx, "accessKeyResource", &descope.AccessKeyArgs{
	ProjectId:        pulumi.String("string"),
	BoundUserId:      pulumi.String("string"),
	CustomAttributes: pulumi.String("string"),
	CustomClaims:     pulumi.String("string"),
	Description:      pulumi.String("string"),
	ExpireTime:       pulumi.Int(0),
	Name:             pulumi.String("string"),
	PermittedIps: pulumi.StringArray{
		pulumi.String("string"),
	},
	Roles: pulumi.StringArray{
		pulumi.String("string"),
	},
	Status: pulumi.String("string"),
	Tenants: descope.AccessKeyTenantArray{
		&descope.AccessKeyTenantArgs{
			TenantId: pulumi.String("string"),
			Roles: pulumi.StringArray{
				pulumi.String("string"),
			},
		},
	},
})

    resource "descope_access_key" "accessKeyResource" {
  lifecycle {
    create_before_destroy = true
  }
  project_id        = "string"
  bound_user_id     = "string"
  custom_attributes = "string"
  custom_claims     = "string"
  description       = "string"
  expire_time       = 0
  name              = "string"
  permitted_ips     = ["string"]
  roles             = ["string"]
  status            = "string"
  tenants {
    tenant_id = "string"
    roles     = ["string"]
  }
}

    var accessKeyResource = new AccessKey("accessKeyResource", AccessKeyArgs.builder()
    .projectId("string")
    .boundUserId("string")
    .customAttributes("string")
    .customClaims("string")
    .description("string")
    .expireTime(0)
    .name("string")
    .permittedIps("string")
    .roles("string")
    .status("string")
    .tenants(AccessKeyTenantArgs.builder()
        .tenantId("string")
        .roles("string")
        .build())
    .build());

    access_key_resource = descope.AccessKey("accessKeyResource",
    project_id="string",
    bound_user_id="string",
    custom_attributes="string",
    custom_claims="string",
    description="string",
    expire_time=0,
    name="string",
    permitted_ips=["string"],
    roles=["string"],
    status="string",
    tenants=[{
        "tenant_id": "string",
        "roles": ["string"],
    }])

    const accessKeyResource = new descope.AccessKey("accessKeyResource", {
    projectId: "string",
    boundUserId: "string",
    customAttributes: "string",
    customClaims: "string",
    description: "string",
    expireTime: 0,
    name: "string",
    permittedIps: ["string"],
    roles: ["string"],
    status: "string",
    tenants: [{
        tenantId: "string",
        roles: ["string"],
    }],
});

    type: descope:AccessKey
properties:
    boundUserId: string
    customAttributes: string
    customClaims: string
    description: string
    expireTime: 0
    name: string
    permittedIps:
        - string
    projectId: string
    roles:
        - string
    status: string
    tenants:
        - roles:
            - string
          tenantId: string

    AccessKey Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AccessKey resource accepts the following input properties:

    ProjectId string
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    BoundUserId string
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    CustomAttributes string
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    CustomClaims string
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    Description string
    A description for the access key.
    ExpireTime int
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    Name string
    A name for the access key.
    PermittedIps List<string>
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    Roles List<string>
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    Status string
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    Tenants List<Descope.AccessKeyTenant>
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    ProjectId string
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    BoundUserId string
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    CustomAttributes string
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    CustomClaims string
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    Description string
    A description for the access key.
    ExpireTime int
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    Name string
    A name for the access key.
    PermittedIps []string
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    Roles []string
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    Status string
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    Tenants []AccessKeyTenantArgs
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    project_id string
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    bound_user_id string
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    custom_attributes string
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    custom_claims string
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description string
    A description for the access key.
    expire_time number
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name string
    A name for the access key.
    permitted_ips list(string)
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    roles list(string)
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status string
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants list(object)
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    projectId String
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    boundUserId String
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    customAttributes String
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    customClaims String
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description String
    A description for the access key.
    expireTime Integer
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name String
    A name for the access key.
    permittedIps List<String>
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    roles List<String>
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status String
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants List<AccessKeyTenant>
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    projectId string
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    boundUserId string
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    customAttributes string
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    customClaims string
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description string
    A description for the access key.
    expireTime number
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name string
    A name for the access key.
    permittedIps string[]
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    roles string[]
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status string
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants AccessKeyTenant[]
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    project_id str
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    bound_user_id str
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    custom_attributes str
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    custom_claims str
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description str
    A description for the access key.
    expire_time int
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name str
    A name for the access key.
    permitted_ips Sequence[str]
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    roles Sequence[str]
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status str
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants Sequence[AccessKeyTenantArgs]
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    projectId String
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    boundUserId String
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    customAttributes String
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    customClaims String
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description String
    A description for the access key.
    expireTime Number
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name String
    A name for the access key.
    permittedIps List<String>
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    roles List<String>
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status String
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants List<Property Map>
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AccessKey resource produces the following output properties:

    Cleartext string
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    ClientId string
    CreatedBy string
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    CreatedTime int
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    Id string
    The provider-assigned unique ID for this managed resource.
    Cleartext string
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    ClientId string
    CreatedBy string
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    CreatedTime int
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    Id string
    The provider-assigned unique ID for this managed resource.
    cleartext string
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    client_id string
    created_by string
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    created_time number
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    id string
    The provider-assigned unique ID for this managed resource.
    cleartext String
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    clientId String
    createdBy String
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    createdTime Integer
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    id String
    The provider-assigned unique ID for this managed resource.
    cleartext string
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    clientId string
    createdBy string
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    createdTime number
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    id string
    The provider-assigned unique ID for this managed resource.
    cleartext str
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    client_id str
    created_by str
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    created_time int
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    id str
    The provider-assigned unique ID for this managed resource.
    cleartext String
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    clientId String
    createdBy String
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    createdTime Number
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing AccessKey Resource

    Get an existing AccessKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AccessKeyState, opts?: CustomResourceOptions): AccessKey
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        bound_user_id: Optional[str] = None,
        cleartext: Optional[str] = None,
        client_id: Optional[str] = None,
        created_by: Optional[str] = None,
        created_time: Optional[int] = None,
        custom_attributes: Optional[str] = None,
        custom_claims: Optional[str] = None,
        description: Optional[str] = None,
        expire_time: Optional[int] = None,
        name: Optional[str] = None,
        permitted_ips: Optional[Sequence[str]] = None,
        project_id: Optional[str] = None,
        roles: Optional[Sequence[str]] = None,
        status: Optional[str] = None,
        tenants: Optional[Sequence[AccessKeyTenantArgs]] = None) -> AccessKey
    func GetAccessKey(ctx *Context, name string, id IDInput, state *AccessKeyState, opts ...ResourceOption) (*AccessKey, error)
    public static AccessKey Get(string name, Input<string> id, AccessKeyState? state, CustomResourceOptions? opts = null)
    public static AccessKey get(String name, Output<String> id, AccessKeyState state, CustomResourceOptions options)
    resources:  _:    type: descope:AccessKey    get:      id: ${id}
    import {
  to = descope_access_key.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    BoundUserId string
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    Cleartext string
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    ClientId string
    CreatedBy string
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    CreatedTime int
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    CustomAttributes string
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    CustomClaims string
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    Description string
    A description for the access key.
    ExpireTime int
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    Name string
    A name for the access key.
    PermittedIps List<string>
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    ProjectId string
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    Roles List<string>
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    Status string
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    Tenants List<Descope.AccessKeyTenant>
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    BoundUserId string
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    Cleartext string
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    ClientId string
    CreatedBy string
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    CreatedTime int
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    CustomAttributes string
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    CustomClaims string
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    Description string
    A description for the access key.
    ExpireTime int
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    Name string
    A name for the access key.
    PermittedIps []string
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    ProjectId string
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    Roles []string
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    Status string
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    Tenants []AccessKeyTenantArgs
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    bound_user_id string
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    cleartext string
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    client_id string
    created_by string
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    created_time number
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    custom_attributes string
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    custom_claims string
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description string
    A description for the access key.
    expire_time number
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name string
    A name for the access key.
    permitted_ips list(string)
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    project_id string
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    roles list(string)
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status string
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants list(object)
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    boundUserId String
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    cleartext String
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    clientId String
    createdBy String
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    createdTime Integer
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    customAttributes String
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    customClaims String
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description String
    A description for the access key.
    expireTime Integer
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name String
    A name for the access key.
    permittedIps List<String>
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    projectId String
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    roles List<String>
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status String
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants List<AccessKeyTenant>
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    boundUserId string
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    cleartext string
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    clientId string
    createdBy string
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    createdTime number
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    customAttributes string
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    customClaims string
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description string
    A description for the access key.
    expireTime number
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name string
    A name for the access key.
    permittedIps string[]
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    projectId string
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    roles string[]
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status string
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants AccessKeyTenant[]
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    bound_user_id str
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    cleartext str
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    client_id str
    created_by str
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    created_time int
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    custom_attributes str
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    custom_claims str
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description str
    A description for the access key.
    expire_time int
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name str
    A name for the access key.
    permitted_ips Sequence[str]
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    project_id str
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    roles Sequence[str]
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status str
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants Sequence[AccessKeyTenantArgs]
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.
    boundUserId String
    The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
    cleartext String
    The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
    clientId String
    createdBy String
    The ID of the user or management key that created the access key. This value is set by the server and is read-only.
    createdTime Number
    The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
    customAttributes String
    A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
    customClaims String
    A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
    description String
    A description for the access key.
    expireTime Number
    The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
    name String
    A name for the access key.
    permittedIps List<String>
    A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
    projectId String
    The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
    roles List<String>
    A list of project-level roles to grant to the access key. Cannot be used together with tenants.
    status String
    The status of the access key. Must be either active or inactive. A new access key cannot be created with an inactive status.
    tenants List<Property Map>
    A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with roles.

    Supporting Types

    AccessKeyTenant, AccessKeyTenantArgs

    TenantId string
    The ID of the tenant to associate with the access key.
    Roles List<string>
    The roles the access key will be granted within the tenant.
    TenantId string
    The ID of the tenant to associate with the access key.
    Roles []string
    The roles the access key will be granted within the tenant.
    tenant_id string
    The ID of the tenant to associate with the access key.
    roles list(string)
    The roles the access key will be granted within the tenant.
    tenantId String
    The ID of the tenant to associate with the access key.
    roles List<String>
    The roles the access key will be granted within the tenant.
    tenantId string
    The ID of the tenant to associate with the access key.
    roles string[]
    The roles the access key will be granted within the tenant.
    tenant_id str
    The ID of the tenant to associate with the access key.
    roles Sequence[str]
    The roles the access key will be granted within the tenant.
    tenantId String
    The ID of the tenant to associate with the access key.
    roles List<String>
    The roles the access key will be granted within the tenant.

    Package Details

    Repository
    descope descope/pulumi-descope
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the descope Terraform Provider.
    descope logo
    Viewing docs for Descope v0.3.13
    published on Tuesday, Jul 14, 2026 by Descope
    Schema (JSON)
    descope/pulumi-descope

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial