Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Logfire
  4. API Docs
  5. FrontendApplicationToken
Viewing docs for Logfire v0.1.21
published on Wednesday, Sep 9, 2026 by Pydantic
Schema (JSON)
pydantic/pulumi-logfire

logfire.FrontendApplicationToken

logfire logo
Viewing docs for Logfire v0.1.21
published on Wednesday, Sep 9, 2026 by Pydantic
Schema (JSON)
pydantic/pulumi-logfire

    Experimental: the backing management API is currently enabled only in Logfire staging environments. Manages one active token for a Logfire frontend application. Rotate in two applies with two resource blocks: add the replacement and deploy its token, then remove the old resource to revoke it. The provider never revokes an old token while creating a new one. Token issuance is not retried automatically because the operation is not idempotent; after an uncertain failure, list the application’s tokens and adopt the one unambiguous new active token. Before destroying the whole application tree, set the last token’s revoke_on_destroy to false in a separate apply; application deletion then revokes every attached token.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as logfire from "@pydantic/pulumi-logfire";

const current = new logfire.FrontendApplicationToken("current", {
    projectId: logfire_frontend_application.browser.project_id,
    applicationId: logfire_frontend_application.browser.id,
    adoptTokenId: logfire_frontend_application.browser.token_id,
});
// First apply with both resources. Deploy the replacement output everywhere.
// Then remove `current` and apply again to revoke the previous token.
const replacement = new logfire.FrontendApplicationToken("replacement", {
    projectId: logfire_frontend_application.browser.project_id,
    applicationId: logfire_frontend_application.browser.id,
    revokeOnDestroy: true,
});
export const rotatedBrowserWriteToken = replacement.token;

    import pulumi
import pulumi_logfire as logfire

current = logfire.FrontendApplicationToken("current",
    project_id=logfire_frontend_application["browser"]["project_id"],
    application_id=logfire_frontend_application["browser"]["id"],
    adopt_token_id=logfire_frontend_application["browser"]["token_id"])
# First apply with both resources. Deploy the replacement output everywhere.
# Then remove `current` and apply again to revoke the previous token.
replacement = logfire.FrontendApplicationToken("replacement",
    project_id=logfire_frontend_application["browser"]["project_id"],
    application_id=logfire_frontend_application["browser"]["id"],
    revoke_on_destroy=True)
pulumi.export("rotatedBrowserWriteToken", replacement.token)

    package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pydantic/pulumi-logfire/sdk/go/logfire"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := logfire.NewFrontendApplicationToken(ctx, "current", &logfire.FrontendApplicationTokenArgs{
			ProjectId:     pulumi.Any(logfire_frontend_application.Browser.Project_id),
			ApplicationId: pulumi.Any(logfire_frontend_application.Browser.Id),
			AdoptTokenId:  pulumi.Any(logfire_frontend_application.Browser.Token_id),
		})
		if err != nil {
			return err
		}
		// First apply with both resources. Deploy the replacement output everywhere.
		// Then remove `current` and apply again to revoke the previous token.
		replacement, err := logfire.NewFrontendApplicationToken(ctx, "replacement", &logfire.FrontendApplicationTokenArgs{
			ProjectId:       pulumi.Any(logfire_frontend_application.Browser.Project_id),
			ApplicationId:   pulumi.Any(logfire_frontend_application.Browser.Id),
			RevokeOnDestroy: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		ctx.Export("rotatedBrowserWriteToken", replacement.Token)
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Logfire = Pulumi.Logfire;

return await Deployment.RunAsync(() => 
{
    var current = new Logfire.FrontendApplicationToken("current", new()
    {
        ProjectId = logfire_frontend_application.Browser.Project_id,
        ApplicationId = logfire_frontend_application.Browser.Id,
        AdoptTokenId = logfire_frontend_application.Browser.Token_id,
    });

    // First apply with both resources. Deploy the replacement output everywhere.
    // Then remove `current` and apply again to revoke the previous token.
    var replacement = new Logfire.FrontendApplicationToken("replacement", new()
    {
        ProjectId = logfire_frontend_application.Browser.Project_id,
        ApplicationId = logfire_frontend_application.Browser.Id,
        RevokeOnDestroy = true,
    });

    return new Dictionary<string, object?>
    {
        ["rotatedBrowserWriteToken"] = replacement.Token,
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.logfire.FrontendApplicationToken;
import com.pulumi.logfire.FrontendApplicationTokenArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var current = new FrontendApplicationToken("current", FrontendApplicationTokenArgs.builder()
            .projectId(logfire_frontend_application.browser().project_id())
            .applicationId(logfire_frontend_application.browser().id())
            .adoptTokenId(logfire_frontend_application.browser().token_id())
            .build());

        // First apply with both resources. Deploy the replacement output everywhere.
        // Then remove `current` and apply again to revoke the previous token.
        var replacement = new FrontendApplicationToken("replacement", FrontendApplicationTokenArgs.builder()
            .projectId(logfire_frontend_application.browser().project_id())
            .applicationId(logfire_frontend_application.browser().id())
            .revokeOnDestroy(true)
            .build());

        ctx.export("rotatedBrowserWriteToken", replacement.token());
    }
}

    resources:
  current:
    type: logfire:FrontendApplicationToken
    properties:
      projectId: ${logfire_frontend_application.browser.project_id}
      applicationId: ${logfire_frontend_application.browser.id}
      adoptTokenId: ${logfire_frontend_application.browser.token_id}
  # First apply with both resources. Deploy the replacement output everywhere.
  # Then remove `current` and apply again to revoke the previous token.
  replacement:
    type: logfire:FrontendApplicationToken
    properties:
      projectId: ${logfire_frontend_application.browser.project_id}
      applicationId: ${logfire_frontend_application.browser.id}
      # Before destroying the whole application tree, set this to false and apply.
      #   # The following destroy can then let application deletion revoke this last token.
      revokeOnDestroy: true
outputs:
  rotatedBrowserWriteToken: ${replacement.token}

    Example coming soon!

    Create FrontendApplicationToken Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new FrontendApplicationToken(name: string, args: FrontendApplicationTokenArgs, opts?: CustomResourceOptions);
    @overload
def FrontendApplicationToken(resource_name: str,
                             args: FrontendApplicationTokenArgs,
                             opts: Optional[ResourceOptions] = None)

@overload
def FrontendApplicationToken(resource_name: str,
                             opts: Optional[ResourceOptions] = None,
                             application_id: Optional[str] = None,
                             project_id: Optional[str] = None,
                             adopt_token_id: Optional[str] = None,
                             revoke_on_destroy: Optional[bool] = None)
    func NewFrontendApplicationToken(ctx *Context, name string, args FrontendApplicationTokenArgs, opts ...ResourceOption) (*FrontendApplicationToken, error)
    public FrontendApplicationToken(string name, FrontendApplicationTokenArgs args, CustomResourceOptions? opts = null)
    public FrontendApplicationToken(String name, FrontendApplicationTokenArgs args)
public FrontendApplicationToken(String name, FrontendApplicationTokenArgs args, CustomResourceOptions options)

    type: logfire:FrontendApplicationToken
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "logfire_frontend_application_token" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args FrontendApplicationTokenArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FrontendApplicationTokenArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FrontendApplicationTokenArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FrontendApplicationTokenArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FrontendApplicationTokenArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var frontendApplicationTokenResource = new Logfire.FrontendApplicationToken("frontendApplicationTokenResource", new()
{
    ApplicationId = "string",
    ProjectId = "string",
    AdoptTokenId = "string",
    RevokeOnDestroy = false,
});

    example, err := logfire.NewFrontendApplicationToken(ctx, "frontendApplicationTokenResource", &logfire.FrontendApplicationTokenArgs{
	ApplicationId:   pulumi.String("string"),
	ProjectId:       pulumi.String("string"),
	AdoptTokenId:    pulumi.String("string"),
	RevokeOnDestroy: pulumi.Bool(false),
})

    resource "logfire_frontend_application_token" "frontendApplicationTokenResource" {
  lifecycle {
    create_before_destroy = true
  }
  application_id    = "string"
  project_id        = "string"
  adopt_token_id    = "string"
  revoke_on_destroy = false
}

    var frontendApplicationTokenResource = new FrontendApplicationToken("frontendApplicationTokenResource", FrontendApplicationTokenArgs.builder()
    .applicationId("string")
    .projectId("string")
    .adoptTokenId("string")
    .revokeOnDestroy(false)
    .build());

    frontend_application_token_resource = logfire.FrontendApplicationToken("frontendApplicationTokenResource",
    application_id="string",
    project_id="string",
    adopt_token_id="string",
    revoke_on_destroy=False)

    const frontendApplicationTokenResource = new logfire.FrontendApplicationToken("frontendApplicationTokenResource", {
    applicationId: "string",
    projectId: "string",
    adoptTokenId: "string",
    revokeOnDestroy: false,
});

    type: logfire:FrontendApplicationToken
properties:
    adoptTokenId: string
    applicationId: string
    projectId: string
    revokeOnDestroy: false

    FrontendApplicationToken Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The FrontendApplicationToken resource accepts the following input properties:

    ApplicationId string
    UUID of the frontend application.
    ProjectId string
    UUID of the project that owns the application.
    AdoptTokenId string
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    RevokeOnDestroy bool
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    ApplicationId string
    UUID of the frontend application.
    ProjectId string
    UUID of the project that owns the application.
    AdoptTokenId string
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    RevokeOnDestroy bool
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    application_id string
    UUID of the frontend application.
    project_id string
    UUID of the project that owns the application.
    adopt_token_id string
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    revoke_on_destroy bool
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    applicationId String
    UUID of the frontend application.
    projectId String
    UUID of the project that owns the application.
    adoptTokenId String
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    revokeOnDestroy Boolean
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    applicationId string
    UUID of the frontend application.
    projectId string
    UUID of the project that owns the application.
    adoptTokenId string
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    revokeOnDestroy boolean
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    application_id str
    UUID of the frontend application.
    project_id str
    UUID of the project that owns the application.
    adopt_token_id str
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    revoke_on_destroy bool
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    applicationId String
    UUID of the frontend application.
    projectId String
    UUID of the project that owns the application.
    adoptTokenId String
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    revokeOnDestroy Boolean
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the FrontendApplicationToken resource produces the following output properties:

    CreatedAt string
    Timestamp when the token was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUsedAt string
    Timestamp when the token was last used, when known.
    Status string
    Token status. A managed token remains in state only while active.
    Token string
    Active restricted browser token. The provider recovers this value on refresh and import.
    CreatedAt string
    Timestamp when the token was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUsedAt string
    Timestamp when the token was last used, when known.
    Status string
    Token status. A managed token remains in state only while active.
    Token string
    Active restricted browser token. The provider recovers this value on refresh and import.
    created_at string
    Timestamp when the token was created.
    id string
    The provider-assigned unique ID for this managed resource.
    last_used_at string
    Timestamp when the token was last used, when known.
    status string
    Token status. A managed token remains in state only while active.
    token string
    Active restricted browser token. The provider recovers this value on refresh and import.
    createdAt String
    Timestamp when the token was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUsedAt String
    Timestamp when the token was last used, when known.
    status String
    Token status. A managed token remains in state only while active.
    token String
    Active restricted browser token. The provider recovers this value on refresh and import.
    createdAt string
    Timestamp when the token was created.
    id string
    The provider-assigned unique ID for this managed resource.
    lastUsedAt string
    Timestamp when the token was last used, when known.
    status string
    Token status. A managed token remains in state only while active.
    token string
    Active restricted browser token. The provider recovers this value on refresh and import.
    created_at str
    Timestamp when the token was created.
    id str
    The provider-assigned unique ID for this managed resource.
    last_used_at str
    Timestamp when the token was last used, when known.
    status str
    Token status. A managed token remains in state only while active.
    token str
    Active restricted browser token. The provider recovers this value on refresh and import.
    createdAt String
    Timestamp when the token was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUsedAt String
    Timestamp when the token was last used, when known.
    status String
    Token status. A managed token remains in state only while active.
    token String
    Active restricted browser token. The provider recovers this value on refresh and import.

    Look up Existing FrontendApplicationToken Resource

    Get an existing FrontendApplicationToken resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: FrontendApplicationTokenState, opts?: CustomResourceOptions): FrontendApplicationToken
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        adopt_token_id: Optional[str] = None,
        application_id: Optional[str] = None,
        created_at: Optional[str] = None,
        last_used_at: Optional[str] = None,
        project_id: Optional[str] = None,
        revoke_on_destroy: Optional[bool] = None,
        status: Optional[str] = None,
        token: Optional[str] = None) -> FrontendApplicationToken
    func GetFrontendApplicationToken(ctx *Context, name string, id IDInput, state *FrontendApplicationTokenState, opts ...ResourceOption) (*FrontendApplicationToken, error)
    public static FrontendApplicationToken Get(string name, Input<string> id, FrontendApplicationTokenState? state, CustomResourceOptions? opts = null)
    public static FrontendApplicationToken get(String name, Output<String> id, FrontendApplicationTokenState state, CustomResourceOptions options)
    resources:  _:    type: logfire:FrontendApplicationToken    get:      id: ${id}
    import {
  to = logfire_frontend_application_token.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AdoptTokenId string
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    ApplicationId string
    UUID of the frontend application.
    CreatedAt string
    Timestamp when the token was created.
    LastUsedAt string
    Timestamp when the token was last used, when known.
    ProjectId string
    UUID of the project that owns the application.
    RevokeOnDestroy bool
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    Status string
    Token status. A managed token remains in state only while active.
    Token string
    Active restricted browser token. The provider recovers this value on refresh and import.
    AdoptTokenId string
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    ApplicationId string
    UUID of the frontend application.
    CreatedAt string
    Timestamp when the token was created.
    LastUsedAt string
    Timestamp when the token was last used, when known.
    ProjectId string
    UUID of the project that owns the application.
    RevokeOnDestroy bool
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    Status string
    Token status. A managed token remains in state only while active.
    Token string
    Active restricted browser token. The provider recovers this value on refresh and import.
    adopt_token_id string
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    application_id string
    UUID of the frontend application.
    created_at string
    Timestamp when the token was created.
    last_used_at string
    Timestamp when the token was last used, when known.
    project_id string
    UUID of the project that owns the application.
    revoke_on_destroy bool
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    status string
    Token status. A managed token remains in state only while active.
    token string
    Active restricted browser token. The provider recovers this value on refresh and import.
    adoptTokenId String
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    applicationId String
    UUID of the frontend application.
    createdAt String
    Timestamp when the token was created.
    lastUsedAt String
    Timestamp when the token was last used, when known.
    projectId String
    UUID of the project that owns the application.
    revokeOnDestroy Boolean
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    status String
    Token status. A managed token remains in state only while active.
    token String
    Active restricted browser token. The provider recovers this value on refresh and import.
    adoptTokenId string
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    applicationId string
    UUID of the frontend application.
    createdAt string
    Timestamp when the token was created.
    lastUsedAt string
    Timestamp when the token was last used, when known.
    projectId string
    UUID of the project that owns the application.
    revokeOnDestroy boolean
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    status string
    Token status. A managed token remains in state only while active.
    token string
    Active restricted browser token. The provider recovers this value on refresh and import.
    adopt_token_id str
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    application_id str
    UUID of the frontend application.
    created_at str
    Timestamp when the token was created.
    last_used_at str
    Timestamp when the token was last used, when known.
    project_id str
    UUID of the project that owns the application.
    revoke_on_destroy bool
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    status str
    Token status. A managed token remains in state only while active.
    token str
    Active restricted browser token. The provider recovers this value on refresh and import.
    adoptTokenId String
    Existing active token to adopt instead of issuing another. Use the application's token_id for the initial handoff, then remove this resource only after a separately managed replacement has been deployed.
    applicationId String
    UUID of the frontend application.
    createdAt String
    Timestamp when the token was created.
    lastUsedAt String
    Timestamp when the token was last used, when known.
    projectId String
    UUID of the project that owns the application.
    revokeOnDestroy Boolean
    Revoke this token when its resource is destroyed. Before destroying the entire application tree, set this to false in a separate apply for the last token so application deletion can revoke all attached tokens.
    status String
    Token status. A managed token remains in state only while active.
    token String
    Active restricted browser token. The provider recovers this value on refresh and import.

    Import

    The pulumi import command can be used, for example:

    $ pulumi import logfire:index/frontendApplicationToken:FrontendApplicationToken current "project-id/application-id/token-id"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    logfire pydantic/pulumi-logfire
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the logfire Terraform Provider.
    logfire logo
    Viewing docs for Logfire v0.1.21
    published on Wednesday, Sep 9, 2026 by Pydantic
    Schema (JSON)
    pydantic/pulumi-logfire

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial