Terraform Provider for Ory Network

Special Thanks Shoutout to Jason Hernandez and the Materialize team for creating the initial version of this provider! Also see NOTICE.md

A Terraform provider for managing Ory Network resources using infrastructure-as-code.

Note: This provider is for Ory Network (the managed SaaS offering) only. It does not support self-hosted Ory deployments.

Requirements

• Terraform >= 1.0
• Go (see version in go.mod; for building from source)
• An Ory Network account

Installation

terraform {
  required_providers {
    ory = {
      source = "ory/ory"
    }
  }
}

Authentication

Ory Network uses two types of API keys:

export ORY_WORKSPACE_API_KEY="ory_wak_..."
export ORY_PROJECT_API_KEY="ory_pat_..."
export ORY_PROJECT_ID="your-project-uuid"
export ORY_PROJECT_SLUG="your-project-slug"

Or configure directly in the provider block:

provider "ory" {
  workspace_api_key = var.ory_workspace_key  # or ORY_WORKSPACE_API_KEY env var
  project_api_key   = var.ory_project_key    # or ORY_PROJECT_API_KEY env var
  project_id        = var.ory_project_id     # or ORY_PROJECT_ID env var
  project_slug      = var.ory_project_slug   # or ORY_PROJECT_SLUG env var
}

Quick Start

terraform {
  required_providers {
    ory = {
      source = "ory/ory"
    }
  }
}

provider "ory" {}

# Configure project settings
resource "ory_project_config" "main" {
  cors_enabled                                            = true
  cors_origins                                            = ["https://app.example.com"]
  selfservice_methods_password_config_min_password_length = 10
  session_lifespan                                        = "720h0m0s" # 30 days
}

# Add Google social login
resource "ory_social_provider" "google" {
  provider_id   = "google"
  provider_type = "google"
  client_id     = var.google_client_id
  client_secret = var.google_client_secret
  scope         = ["email", "profile"]
}

# Create a webhook for new registrations
resource "ory_action" "welcome_email" {
  flow        = "registration"
  timing      = "after"
  auth_method = "password"
  url         = "https://api.example.com/webhooks/welcome"
  method      = "POST"
}

For all available resources, data sources, and their attributes, see the Terraform Registry documentation or browse the examples/ directory.

Importing an Existing Project

Already have an Ory Network project configured through the Console? You can adopt Terraform without recreating anything:

export ORY_WORKSPACE_API_KEY=ory_wak_...
export ORY_PROJECT_API_KEY=ory_pat_...   # optional: covers OAuth2 clients, JWKS, ...
export ORY_PROJECT_ID=

# Inventory the project and emit import blocks for everything importable
./.claude/skills/import-existing-project/scripts/generate-imports.sh > imports.tf

# Generate matching resource configuration, then refine until `terraform plan` is clean
terraform plan -generate-config-out=generated.tf

The full runbook — per-resource discovery endpoints, import ID formats, what cannot be imported (identity schemas, API key values, secrets), and how to refine the generated config — lives in .claude/skills/import-existing-project/SKILL.md. It is packaged as an agent skill, so coding agents pick it up automatically from .claude/skills/, and it doubles as a step-by-step guide for humans.

Documentation

Documentation is auto-generated from templates in templates/ using tfplugindocs. Do NOT edit files in docs/ directly — they are overwritten by make format.

Contributing

See CONTRIBUTING.md for development setup, testing, and contribution guidelines.

License

Apache License, Version 2.0. See LICENSE.

Related Links

• Ory Network Documentation
• Ory API Reference
• Terraform Provider Development