@mstuercke/pulumi-modules 1.2.3 → 1.3.0

package/dist/clerk/Clerk.d.ts

@@ -0,0 +1,27 @@
+import { ComponentResource, type ComponentResourceOptions, type Output } from '@pulumi/pulumi';
+export type ClerkURL = `http://${string}` | `https://${string}`;
+export type ClerkUser = {
+    name: string;
+    email: string;
+    password: string;
+    emailVerified: boolean;
+    appMetadata?: Record<string, unknown>;
+};
+export type ClerkArgs = {
+    projectId: string;
+    environmentName: string;
+    allowedUrls: ClerkURL[];
+    platformApiKey: string;
+    displayName?: string;
+    allowedRedirectUrls?: ClerkURL[];
+    nativeAppId?: string;
+    defaultUsers?: ClerkUser[];
+    disableSignup?: boolean;
+};
+export declare class Clerk extends ComponentResource {
+    applicationId: Output<string>;
+    instanceId: Output<string>;
+    publishableKey: Output<string>;
+    secretKey: Output<string>;
+    constructor(name: string, args: ClerkArgs, opts?: ComponentResourceOptions);
+}

package/dist/clerk/Clerk.js

@@ -0,0 +1,88 @@
+import { ComponentResource, secret } from '@pulumi/pulumi';
+import { Application, InstanceConfig, Provider, RedirectUrl, User } from '@pulumi/clerk';
+const getClerkAllowedOrigins = (allowedUrls) => {
+    const origins = [];
+    for (const allowedUrl of allowedUrls) {
+        origins.push(new URL(allowedUrl).origin);
+    }
+    return origins;
+};
+const getClerkRedirectUrls = (allowedUrls, allowedRedirectUrls, nativeAppId) => {
+    const redirectUrls = [...(allowedRedirectUrls ?? allowedUrls)];
+    if (nativeAppId) {
+        redirectUrls.push(`${nativeAppId}://oauth-callback`);
+    }
+    return redirectUrls;
+};
+const getClerkUserNames = (name) => {
+    const [firstName, ...lastNameParts] = name.split(' ');
+    return {
+        firstName: firstName || name,
+        lastName: lastNameParts.length > 0 ? lastNameParts.join(' ') : undefined,
+    };
+};
+export class Clerk extends ComponentResource {
+    applicationId;
+    instanceId;
+    publishableKey;
+    secretKey;
+    constructor(name, args, opts) {
+        super('mstuercke:clerk:Clerk', name, undefined, opts);
+        const { projectId, environmentName, allowedUrls, platformApiKey, displayName = `${projectId}-${environmentName}`, allowedRedirectUrls, nativeAppId, defaultUsers = [], disableSignup = false, } = args;
+        const environmentType = environmentName === 'prod' ? 'production' : 'development';
+        const platformProvider = new Provider(`${name}-platform`, { platformApiKey }, { parent: this });
+        const application = new Application(name, {
+            name: displayName,
+            environmentTypes: [environmentType],
+        }, { parent: this, provider: platformProvider });
+        const instance = application.instances.apply((instances) => {
+            const matchingInstance = instances.find((item) => item.environmentType === environmentType);
+            const selectedInstance = matchingInstance ?? instances[0];
+            if (!selectedInstance) {
+                throw new Error(`Clerk application ${displayName} has no instances`);
+            }
+            return selectedInstance;
+        });
+        const instanceProvider = new Provider(`${name}-instance`, {
+            platformApiKey,
+            apiKey: instance.apply((item) => item.secretKey),
+        }, { parent: this });
+        new InstanceConfig(name, {
+            applicationId: application.id,
+            instanceId: instance.apply((item) => item.instanceId),
+            config: JSON.stringify({
+                auth_email: {
+                    used_for_sign_up: true,
+                    used_for_sign_in: true,
+                },
+                auth_password: {
+                    required: true,
+                },
+                hibp: true,
+                sign_up_mode: disableSignup ? 'restricted' : 'public',
+                allowed_origins: getClerkAllowedOrigins(allowedUrls),
+                ...(environmentType === 'development' ? { url_based_session_syncing: true } : {}),
+            }),
+        }, { parent: this, provider: platformProvider });
+        const redirectUrls = getClerkRedirectUrls(allowedUrls, allowedRedirectUrls, nativeAppId);
+        for (const [index, url] of redirectUrls.entries()) {
+            new RedirectUrl(`${name}-redirect-${index}`, { url }, { parent: this, provider: instanceProvider });
+        }
+        for (const defaultUser of defaultUsers) {
+            const { firstName, lastName } = getClerkUserNames(defaultUser.name);
+            new User(`default-user-${defaultUser.email}`, {
+                emailAddresses: [defaultUser.email],
+                password: defaultUser.password,
+                firstName,
+                lastName,
+                skipLegalChecks: true,
+                skipPasswordChecks: true,
+                publicMetadata: defaultUser.appMetadata ? JSON.stringify(defaultUser.appMetadata) : undefined,
+            }, { parent: this, provider: instanceProvider });
+        }
+        this.applicationId = application.id;
+        this.instanceId = instance.apply((item) => item.instanceId);
+        this.publishableKey = instance.apply((item) => item.publishableKey);
+        this.secretKey = secret(instance.apply((item) => item.secretKey));
+    }
+}

package/dist/clerk/index.d.ts

@@ -0,0 +1,5 @@
+import { Clerk } from './Clerk.ts';
+export * from './Clerk.ts';
+export declare const clerk: {
+    Clerk: typeof Clerk;
+};

package/dist/clerk/index.js

@@ -0,0 +1,5 @@
+import { Clerk } from "./Clerk.js";
+export * from "./Clerk.js";
+export const clerk = {
+    Clerk,
+};

package/dist/domain/getDomain.js

@@ -2,8 +2,13 @@ import { acm, route53 } from '@pulumi/aws';
 export const getDomain = async (options) => {
     const { usEast1Provider, name } = options;
     const zone = await route53.getZone({ name });
-    const euCentral1Certificate = await acm.getCertificate({ domain: name });
-    const usEast1Certificate = await acm.getCertificate({ domain: name }, { provider: usEast1Provider });
+    const certificateArgs = {
+        domain: name,
+        mostRecent: true,
+        statuses: ['PENDING_VALIDATION', 'ISSUED', 'INACTIVE', 'EXPIRED', 'VALIDATION_TIMED_OUT', 'REVOKED', 'FAILED'],
+    };
+    const euCentral1Certificate = await acm.getCertificate(certificateArgs);
+    const usEast1Certificate = await acm.getCertificate(certificateArgs, { provider: usEast1Provider });
     return {
         name: zone.name,
         zoneId: zone.zoneId,

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './auth0/index.ts';
+export * from './clerk/index.ts';
 export * from './domain/index.ts';
 export * from './iam/index.ts';
 export * from './lambda/index.ts';
@@ -12,6 +13,9 @@ export declare const mstuercke: {
     auth0: {
         Auth0: typeof import("./auth0/Auth0.ts").Auth0;
     };
+    clerk: {
+        Clerk: typeof import("./clerk/Clerk.ts").Clerk;
+    };
     domain: {
         getDomain: (options: import("./domain/getDomain.ts").DataDomainOptions) => Promise<import("./domain/getDomain.ts").DomainResult>;
     };

package/dist/index.js

@@ -1,4 +1,5 @@
 import { auth0 } from "./auth0/index.js";
+import { clerk } from "./clerk/index.js";
 import { domain } from "./domain/index.js";
 import { iam } from "./iam/index.js";
 import { rest } from "./rest/index.js";
@@ -9,6 +10,7 @@ import { s3 } from "./s3/index.js";
 import { website } from "./website/index.js";
 import { websocket } from "./websocket/index.js";
 export * from "./auth0/index.js";
+export * from "./clerk/index.js";
 export * from "./domain/index.js";
 export * from "./iam/index.js";
 export * from "./lambda/index.js";
@@ -20,6 +22,7 @@ export * from "./website/index.js";
 export * from "./websocket/index.js";
 export const mstuercke = {
     auth0,
+    clerk,
     domain,
     iam,
     lambda,

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@mstuercke/pulumi-modules",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "files": [
     "dist/**/!(*.test|*.fixture){.d.ts,.js}",
+    "sdks/clerk/**",
     "README.md"
   ],
   "type": "module",
@@ -11,15 +12,18 @@
     "types": "./dist/index.d.ts"
   },
   "scripts": {
-    "typeCheck": "tsc --noEmit",
-    "build": "tsc -p tsconfig.build.json",
-    "release": "node --no-warnings --import ts-node/esm scripts/release.ts"
+    "typeCheck": "node sdks/clerk/scripts/postinstall.js && tsc --noEmit",
+    "build": "node sdks/clerk/scripts/postinstall.js && tsc -p tsconfig.build.json",
+    "lint": "biome check && eslint . --max-warnings 0 --no-error-on-unmatched-pattern",
+    "lint:fix": "biome check --fix && eslint . --fix --max-warnings 0 --no-error-on-unmatched-pattern",
+    "prepack": "pnpm run build"
   },
   "dependencies": {
     "@mstuercke/pulumi-neon": "1.0.0",
-    "@pulumi/archive": "^0.3.0",
+    "@pulumi/archive": "^0.5.0",
     "@pulumi/auth0": "^3.8.1",
     "@pulumi/aws": "^7.0.0",
+    "@pulumi/clerk": "link:sdks/clerk",
     "@pulumi/mongodbatlas": "^4.0.0",
     "@pulumi/pulumi": "^3.142.0",
     "@pulumi/random": "^4.16.7",
@@ -29,10 +33,24 @@
     "mime": "^3.0.0"
   },
   "devDependencies": {
-    "@mstuercke/node-utils": "0.0.3",
+    "@biomejs/biome": "^2.0.6",
+    "@mstuercke/biome-config": "0.1.0",
+    "@mstuercke/eslint-config": "1.3.0",
+    "@mstuercke/typescript-config": "3.1.0",
+    "@types/node": "^24.1.0",
+    "eslint": "^8.57.1",
+    "semantic-release": "^25.0.0",
     "typescript": "^6.0.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"
+  },
+  "packageManager": "pnpm@11.25.0",
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/mstuercke/pulumi-modules.git"
   }
 }

package/sdks/clerk/.gitattributes

@@ -0,0 +1 @@
+* linguist-generated

package/sdks/clerk/README.md

@@ -0,0 +1,3 @@
+> This provider is a derived work of the [Terraform Provider](https://github.com/buildwithdeck/terraform-provider-clerk)
+> distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,
+> please consult the source [`terraform-provider-clerk` repo](https://github.com/buildwithdeck/terraform-provider-clerk/issues).

package/sdks/clerk/allowlistIdentifier.ts

@@ -0,0 +1,121 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "./utilities";
+
+export class AllowlistIdentifier extends pulumi.CustomResource {
+    /**
+     * Get an existing AllowlistIdentifier resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AllowlistIdentifierState, opts?: pulumi.CustomResourceOptions): AllowlistIdentifier {
+        return new AllowlistIdentifier(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'clerk:index/allowlistIdentifier:AllowlistIdentifier';
+
+    /**
+     * Returns true if the given object is an instance of AllowlistIdentifier.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is AllowlistIdentifier {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === AllowlistIdentifier.__pulumiType;
+    }
+
+    /**
+     * Timestamp when the allowlist entry was created.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * The identifier to add to the allowlist. Can be an email address, phone number, or web3 wallet address. Supports wildcard
+     * patterns for email addresses (e.g. *@example.com).
+     */
+    declare public readonly identifier: pulumi.Output<string>;
+    /**
+     * Whether to send an invitation email to the identifier upon creation. Only applies to email address identifiers.
+     */
+    declare public readonly notify: pulumi.Output<boolean | undefined>;
+    /**
+     * Timestamp when the allowlist entry was last updated.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+
+    /**
+     * Create a AllowlistIdentifier resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: AllowlistIdentifierArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: AllowlistIdentifierArgs | AllowlistIdentifierState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as AllowlistIdentifierState | undefined;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["identifier"] = state?.identifier;
+            resourceInputs["notify"] = state?.notify;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+        } else {
+            const args = argsOrState as AllowlistIdentifierArgs | undefined;
+            if (args?.identifier === undefined && !opts.urn) {
+                throw new Error("Missing required property 'identifier'");
+            }
+            resourceInputs["identifier"] = args?.identifier;
+            resourceInputs["notify"] = args?.notify;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(AllowlistIdentifier.__pulumiType, name, resourceInputs, opts, false /*dependency*/, utilities.getPackage());
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering AllowlistIdentifier resources.
+ */
+export interface AllowlistIdentifierState {
+    /**
+     * Timestamp when the allowlist entry was created.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * The identifier to add to the allowlist. Can be an email address, phone number, or web3 wallet address. Supports wildcard
+     * patterns for email addresses (e.g. *@example.com).
+     */
+    identifier?: pulumi.Input<string | undefined>;
+    /**
+     * Whether to send an invitation email to the identifier upon creation. Only applies to email address identifiers.
+     */
+    notify?: pulumi.Input<boolean | undefined>;
+    /**
+     * Timestamp when the allowlist entry was last updated.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a AllowlistIdentifier resource.
+ */
+export interface AllowlistIdentifierArgs {
+    /**
+     * The identifier to add to the allowlist. Can be an email address, phone number, or web3 wallet address. Supports wildcard
+     * patterns for email addresses (e.g. *@example.com).
+     */
+    identifier: pulumi.Input<string>;
+    /**
+     * Whether to send an invitation email to the identifier upon creation. Only applies to email address identifiers.
+     */
+    notify?: pulumi.Input<boolean | undefined>;
+}

package/sdks/clerk/apiKey.ts

@@ -0,0 +1,254 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "./utilities";
+
+export class ApiKey extends pulumi.CustomResource {
+    /**
+     * Get an existing ApiKey resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ApiKeyState, opts?: pulumi.CustomResourceOptions): ApiKey {
+        return new ApiKey(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'clerk:index/apiKey:ApiKey';
+
+    /**
+     * Returns true if the given object is an instance of ApiKey.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is ApiKey {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === ApiKey.__pulumiType;
+    }
+
+    /**
+     * JSON string of custom claims for the API key.
+     */
+    declare public readonly claims: pulumi.Output<string>;
+    /**
+     * Timestamp when the API key was created.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Identifier of the entity that created the API key. Set on create only.
+     */
+    declare public readonly createdBy: pulumi.Output<string>;
+    /**
+     * Description of the API key.
+     */
+    declare public readonly description: pulumi.Output<string>;
+    /**
+     * Expiration timestamp in RFC3339 format.
+     */
+    declare public /*out*/ readonly expiration: pulumi.Output<string>;
+    /**
+     * Whether the API key has expired.
+     */
+    declare public /*out*/ readonly expired: pulumi.Output<boolean>;
+    /**
+     * Timestamp when the API key was last used, in RFC3339 format.
+     */
+    declare public /*out*/ readonly lastUsedAt: pulumi.Output<string>;
+    /**
+     * Name of the API key.
+     */
+    declare public readonly name: pulumi.Output<string>;
+    /**
+     * Whether the API key has been revoked.
+     */
+    declare public /*out*/ readonly revoked: pulumi.Output<boolean>;
+    /**
+     * List of scopes for the API key.
+     */
+    declare public readonly scopes: pulumi.Output<string[]>;
+    /**
+     * Number of seconds until the API key expires. Write-only: used on create/update, the API returns an expiration timestamp
+     * instead.
+     */
+    declare public readonly secondsUntilExpiration: pulumi.Output<number | undefined>;
+    /**
+     * The API key secret. Write-only: only returned on creation, not on subsequent reads.
+     */
+    declare public /*out*/ readonly secret: pulumi.Output<string>;
+    /**
+     * Subject of the API key.
+     */
+    declare public readonly subject: pulumi.Output<string>;
+    /**
+     * Type of the API key. Cannot be changed after creation.
+     */
+    declare public readonly type: pulumi.Output<string>;
+    /**
+     * Timestamp when the API key was last updated.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+
+    /**
+     * Create a ApiKey resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args?: ApiKeyArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: ApiKeyArgs | ApiKeyState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as ApiKeyState | undefined;
+            resourceInputs["claims"] = state?.claims;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["createdBy"] = state?.createdBy;
+            resourceInputs["description"] = state?.description;
+            resourceInputs["expiration"] = state?.expiration;
+            resourceInputs["expired"] = state?.expired;
+            resourceInputs["lastUsedAt"] = state?.lastUsedAt;
+            resourceInputs["name"] = state?.name;
+            resourceInputs["revoked"] = state?.revoked;
+            resourceInputs["scopes"] = state?.scopes;
+            resourceInputs["secondsUntilExpiration"] = state?.secondsUntilExpiration;
+            resourceInputs["secret"] = state?.secret;
+            resourceInputs["subject"] = state?.subject;
+            resourceInputs["type"] = state?.type;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+        } else {
+            const args = argsOrState as ApiKeyArgs | undefined;
+            resourceInputs["claims"] = args?.claims;
+            resourceInputs["createdBy"] = args?.createdBy;
+            resourceInputs["description"] = args?.description;
+            resourceInputs["name"] = args?.name;
+            resourceInputs["scopes"] = args?.scopes;
+            resourceInputs["secondsUntilExpiration"] = args?.secondsUntilExpiration;
+            resourceInputs["subject"] = args?.subject;
+            resourceInputs["type"] = args?.type;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["expiration"] = undefined /*out*/;
+            resourceInputs["expired"] = undefined /*out*/;
+            resourceInputs["lastUsedAt"] = undefined /*out*/;
+            resourceInputs["revoked"] = undefined /*out*/;
+            resourceInputs["secret"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["secret"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(ApiKey.__pulumiType, name, resourceInputs, opts, false /*dependency*/, utilities.getPackage());
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering ApiKey resources.
+ */
+export interface ApiKeyState {
+    /**
+     * JSON string of custom claims for the API key.
+     */
+    claims?: pulumi.Input<string | undefined>;
+    /**
+     * Timestamp when the API key was created.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Identifier of the entity that created the API key. Set on create only.
+     */
+    createdBy?: pulumi.Input<string | undefined>;
+    /**
+     * Description of the API key.
+     */
+    description?: pulumi.Input<string | undefined>;
+    /**
+     * Expiration timestamp in RFC3339 format.
+     */
+    expiration?: pulumi.Input<string | undefined>;
+    /**
+     * Whether the API key has expired.
+     */
+    expired?: pulumi.Input<boolean | undefined>;
+    /**
+     * Timestamp when the API key was last used, in RFC3339 format.
+     */
+    lastUsedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Name of the API key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Whether the API key has been revoked.
+     */
+    revoked?: pulumi.Input<boolean | undefined>;
+    /**
+     * List of scopes for the API key.
+     */
+    scopes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Number of seconds until the API key expires. Write-only: used on create/update, the API returns an expiration timestamp
+     * instead.
+     */
+    secondsUntilExpiration?: pulumi.Input<number | undefined>;
+    /**
+     * The API key secret. Write-only: only returned on creation, not on subsequent reads.
+     */
+    secret?: pulumi.Input<string | undefined>;
+    /**
+     * Subject of the API key.
+     */
+    subject?: pulumi.Input<string | undefined>;
+    /**
+     * Type of the API key. Cannot be changed after creation.
+     */
+    type?: pulumi.Input<string | undefined>;
+    /**
+     * Timestamp when the API key was last updated.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a ApiKey resource.
+ */
+export interface ApiKeyArgs {
+    /**
+     * JSON string of custom claims for the API key.
+     */
+    claims?: pulumi.Input<string | undefined>;
+    /**
+     * Identifier of the entity that created the API key. Set on create only.
+     */
+    createdBy?: pulumi.Input<string | undefined>;
+    /**
+     * Description of the API key.
+     */
+    description?: pulumi.Input<string | undefined>;
+    /**
+     * Name of the API key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * List of scopes for the API key.
+     */
+    scopes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Number of seconds until the API key expires. Write-only: used on create/update, the API returns an expiration timestamp
+     * instead.
+     */
+    secondsUntilExpiration?: pulumi.Input<number | undefined>;
+    /**
+     * Subject of the API key.
+     */
+    subject?: pulumi.Input<string | undefined>;
+    /**
+     * Type of the API key. Cannot be changed after creation.
+     */
+    type?: pulumi.Input<string | undefined>;
+}