Connect credentials

Store cloud keys and tokens in a Connection and assign it to Runs. Values are write-only — there is no way to read them back.

Create a Connection

takosumi connections create \
  --provider registry.opentofu.org/example/example \
  --recipe generic-env \
  --auth-mode env \
  --secret-partition provider-credentials \
  --values-file ./provider-credentials.json

Option	Meaning
--provider	the fully qualified provider address
--recipe	the Credential Recipe id; generic-env works for anything
--auth-mode	env (inject as environment variables), and others
--secret-partition	the secret storage partition
--values-file	a JSON object of environment variable names and values
--files-file	credentials to pass as files

Two things to remember:

• --provider must be fully qualified, starting with a hostname. example/example is rejected. Even if your module writes the short form, create the Connection as registry.opentofu.org/example/example.
• If you do not know which environment variables a provider needs, use --recipe generic-env --auth-mode env. The names in --values-file are used as-is.

Test and revoke

• test validates the connection.
• revoke disables it. Revocation is not deletion: later Runs cannot use it, but past Run records remain.

takosumi connections test conn_...
takosumi connections revoke conn_...

How far values go

Values reach the runner only while a Run runs, then disappear. Connections pass them either as environment variables or as files.

You specify the variable and file names yourself, following the provider's official documentation. Nothing is inferred from the provider name.

Next

• Credentials — the model
• CLI — all commands