# Quickstart

> Install and configure the Thoth Terraform provider.

Source: https://docs.atensecurity.com/docs/terraform-provider/quickstart

For an invited trial, use the minimal
[trial settings workflow](https://docs.atensecurity.com/docs/getting-started/trial-settings). It imports
existing settings and requires a separate organization read/write key.

## Prerequisites

- Terraform `>= 1.5`
- Tenant identifier (for example `acme`)
- Org-level API key for control-plane API access (recommended for CI/CD)

## Install provider

```hcl title="main.tf"
terraform {
  required_version = ">= 1.5"

  required_providers {
    thoth = {
      source  = "atensecurity/thoth"
      version = "~> 0.1.16"
    }
  }
}
```

## Configure provider

```hcl title="main.tf"
provider "thoth" {
  tenant_id        = var.tenant_id
  api_base_url     = var.govapi_base_url
  org_api_key_file = var.org_api_key_file
}
```

When `api_base_url` is omitted, the provider derives:

`https://grid.<tenant_id>.<apex_domain>`

For a trial, use the supplied GovAPI base URL explicitly. Keep it separate
from the SDK runtime endpoint.

## API key file alternative

Use `org_api_key_file` instead of placing values directly in HCL:

```hcl title="main.tf"
provider "thoth" {
  tenant_id        = var.tenant_id
  org_api_key_file = pathexpand("~/.thoth/org-api-key.txt")
}
```

## Environment variable alternative

You can export `THOTH_API_KEY` and omit provider auth fields:

```bash title="Terminal"
export THOTH_API_KEY="aten_thoth_<env>_<token>"
export THOTH_TENANT_ID="acme"
```

`THOTH_API_KEY` must be an org-scoped key with read/write permissions.
`THOTH_TENANT_ID` is used when `tenant_id` is omitted.

```hcl title="main.tf"
provider "thoth" {}
```

## Bearer token compatibility

`admin_bearer_token` and `admin_bearer_token_file` remain supported for
interactive/admin session workflows. Configure either bearer token auth or org API key auth.

## Minimal resource example

```hcl title="main.tf"
resource "thoth_governance_settings" "baseline" {
  shadow_low         = "allow"
  shadow_medium      = "step_up"
  shadow_high        = "block"
  shadow_critical    = "block"
}
```

## Related

- [Resources and Data Sources](https://docs.atensecurity.com/docs/terraform-provider/resources-and-data-sources)
- [Provider example configuration](https://github.com/atensecurity/terraform-provider-thoth/tree/main/examples/basic)

## Review changes safely

These examples describe supported provider APIs; they do not create a trial.
Import existing singleton settings before changing them. Review the plan or
preview and keep state, plans, and keys private. Deleting a settings resource
does not restore prior values; apply the saved prior configuration to undo a
change. Only configure integrations enabled for your environment. The
[trial settings guide](https://docs.atensecurity.com/docs/getting-started/trial-settings) gives the minimal