Genesys Cloud - Developer Community!

I am trying to save a clientId and clientsecret. Here is my tf code which seems to be set up right per Genesys' documentation but the value for the id and secret keep coming back null.

{ "client-dev": "{\"client_id\":null,\"client_secret\":null,\"version\":\"5\"}" }

resource "genesyscloud_oauth_client" "client1" {
  name                          = "client1"
  description                   = "TF managed"
  access_token_validity_seconds = 86400
  authorized_grant_type         = "CLIENT-CREDENTIALS"

  roles {
    role_id     = data.genesyscloud_auth_role.admin.id
    division_id = "*"
  }
}

output "client_id" {
  value       = genesyscloud_oauth_client.client1.client_id
  description = "new client id"
}

module "client_oauth_creds" {
  source  = "xxx"
  version = "~> 1.0"

  # name of the secret in a hierarhcy path based standard format
  name = "/secret-lair/classic/terraform-genesyscloud/production/client-dev"

  content_wo = jsonencode({
    "client_id"     = genesyscloud_oauth_client.client1.client_id
    "client_secret" = genesyscloud_oauth_client.client1.client_secret
    "version"       = "6"
  })

  # update this when you want to actually update content in the secret object
  # so that terraform doesn't store the secret in state.
  content_wo_version = 6
  depends_on = [
    genesyscloud_oauth_client.client1
  ]
}

I use 1.68.3 provider version

Hi @Ihor Hordiienko

You can follow the blog here https://developer.genesys.cloud/blog/oath-client-secret-CXasCode/ for accessing clientid and clientsecret via cxAsCode.

we have introduced new attribute directory_client_secret in genesyscloud_oauth_client resource which you can use to dump your client credential information. More details in the blog for reference.

Thanks

Hemanth

I am trying to save a clientId and clientsecret. Here is my tf code which seems to be set up right per Genesys' documentation but the value for the id and secret keep coming back null.

{ "client-dev": "{\"client_id\":null,\"client_secret\":null,\"version\":\"5\"}" }

resource "genesyscloud_oauth_client" "client1" {
  name                          = "client1"
  description                   = "TF managed"
  access_token_validity_seconds = 86400
  authorized_grant_type         = "CLIENT-CREDENTIALS"

  roles {
    role_id     = data.genesyscloud_auth_role.admin.id
    division_id = "*"
  }
}

output "client_id" {
  value       = genesyscloud_oauth_client.client1.client_id
  description = "new client id"
}

module "client_oauth_creds" {
  source  = "xxx"
  version = "~> 1.0"

  # name of the secret in a hierarhcy path based standard format
  name = "/secret-lair/classic/terraform-genesyscloud/production/client-dev"

  content_wo = jsonencode({
    "client_id"     = genesyscloud_oauth_client.client1.client_id
    "client_secret" = genesyscloud_oauth_client.client1.client_secret
    "version"       = "6"
  })

  # update this when you want to actually update content in the secret object
  # so that terraform doesn't store the secret in state.
  content_wo_version = 6
  depends_on = [
    genesyscloud_oauth_client.client1
  ]
}

I use 1.68.3 provider version

Hi Hemanth,

the attribute directory_client_secret just puts a secret into a file on a disk. What I am trying to do is to save it into a proper secret manager.

Hi @Ihor Hordiienko

You can follow the blog here https://developer.genesys.cloud/blog/oath-client-secret-CXasCode/ for accessing clientid and clientsecret via cxAsCode.

we have introduced new attribute directory_client_secret in genesyscloud_oauth_client resource which you can use to dump your client credential information. More details in the blog for reference.

Thanks

Hemanth

I am trying to save a clientId and clientsecret. Here is my tf code which seems to be set up right per Genesys' documentation but the value for the id and secret keep coming back null.

{ "client-dev": "{\"client_id\":null,\"client_secret\":null,\"version\":\"5\"}" }

resource "genesyscloud_oauth_client" "client1" {
  name                          = "client1"
  description                   = "TF managed"
  access_token_validity_seconds = 86400
  authorized_grant_type         = "CLIENT-CREDENTIALS"

  roles {
    role_id     = data.genesyscloud_auth_role.admin.id
    division_id = "*"
  }
}

output "client_id" {
  value       = genesyscloud_oauth_client.client1.client_id
  description = "new client id"
}

module "client_oauth_creds" {
  source  = "xxx"
  version = "~> 1.0"

  # name of the secret in a hierarhcy path based standard format
  name = "/secret-lair/classic/terraform-genesyscloud/production/client-dev"

  content_wo = jsonencode({
    "client_id"     = genesyscloud_oauth_client.client1.client_id
    "client_secret" = genesyscloud_oauth_client.client1.client_secret
    "version"       = "6"
  })

  # update this when you want to actually update content in the secret object
  # so that terraform doesn't store the secret in state.
  content_wo_version = 6
  depends_on = [
    genesyscloud_oauth_client.client1
  ]
}

I use 1.68.3 provider version

Hi @Ihor Hordiienko

• Use directory_client_secret attribute

Hope this helps

Thanks

Hemanth

Hi Hemanth,

the attribute directory_client_secret just puts a secret into a file on a disk. What I am trying to do is to save it into a proper secret manager.

Hi @Ihor Hordiienko

You can follow the blog here https://developer.genesys.cloud/blog/oath-client-secret-CXasCode/ for accessing clientid and clientsecret via cxAsCode.

we have introduced new attribute directory_client_secret in genesyscloud_oauth_client resource which you can use to dump your client credential information. More details in the blog for reference.

Thanks

Hemanth

I am trying to save a clientId and clientsecret. Here is my tf code which seems to be set up right per Genesys' documentation but the value for the id and secret keep coming back null.

{ "client-dev": "{\"client_id\":null,\"client_secret\":null,\"version\":\"5\"}" }

resource "genesyscloud_oauth_client" "client1" {
  name                          = "client1"
  description                   = "TF managed"
  access_token_validity_seconds = 86400
  authorized_grant_type         = "CLIENT-CREDENTIALS"

  roles {
    role_id     = data.genesyscloud_auth_role.admin.id
    division_id = "*"
  }
}

output "client_id" {
  value       = genesyscloud_oauth_client.client1.client_id
  description = "new client id"
}

module "client_oauth_creds" {
  source  = "xxx"
  version = "~> 1.0"

  # name of the secret in a hierarhcy path based standard format
  name = "/secret-lair/classic/terraform-genesyscloud/production/client-dev"

  content_wo = jsonencode({
    "client_id"     = genesyscloud_oauth_client.client1.client_id
    "client_secret" = genesyscloud_oauth_client.client1.client_secret
    "version"       = "6"
  })

  # update this when you want to actually update content in the secret object
  # so that terraform doesn't store the secret in state.
  content_wo_version = 6
  depends_on = [
    genesyscloud_oauth_client.client1
  ]
}

I use 1.68.3 provider version

Hi Hemanth!

The suggested directory_client_secret approach is not workable in our environment. We use terraform enterprise, so we can't have file preserve state across runs.

More importantly, Terraform already has a mechanism for handling one-time values at resource creation: marking them as sensitive. So why the provider doesn't simply expose client_id and client_secret as sensitive outputs during the initial creation run. That would allow us to consume them in other Terraform resources (or export them to a proper secret manager) without needing to persist files locally. This is exactly what Terraform's sensitive feature is intended for.

Hi @Ihor Hordiienko

• Use directory_client_secret attribute

Hope this helps

Thanks

Hemanth

Hi Hemanth,

the attribute directory_client_secret just puts a secret into a file on a disk. What I am trying to do is to save it into a proper secret manager.

Hi @Ihor Hordiienko

You can follow the blog here https://developer.genesys.cloud/blog/oath-client-secret-CXasCode/ for accessing clientid and clientsecret via cxAsCode.

we have introduced new attribute directory_client_secret in genesyscloud_oauth_client resource which you can use to dump your client credential information. More details in the blog for reference.

Thanks

Hemanth

I am trying to save a clientId and clientsecret. Here is my tf code which seems to be set up right per Genesys' documentation but the value for the id and secret keep coming back null.

{ "client-dev": "{\"client_id\":null,\"client_secret\":null,\"version\":\"5\"}" }

resource "genesyscloud_oauth_client" "client1" {
  name                          = "client1"
  description                   = "TF managed"
  access_token_validity_seconds = 86400
  authorized_grant_type         = "CLIENT-CREDENTIALS"

  roles {
    role_id     = data.genesyscloud_auth_role.admin.id
    division_id = "*"
  }
}

output "client_id" {
  value       = genesyscloud_oauth_client.client1.client_id
  description = "new client id"
}

module "client_oauth_creds" {
  source  = "xxx"
  version = "~> 1.0"

  # name of the secret in a hierarhcy path based standard format
  name = "/secret-lair/classic/terraform-genesyscloud/production/client-dev"

  content_wo = jsonencode({
    "client_id"     = genesyscloud_oauth_client.client1.client_id
    "client_secret" = genesyscloud_oauth_client.client1.client_secret
    "version"       = "6"
  })

  # update this when you want to actually update content in the secret object
  # so that terraform doesn't store the secret in state.
  content_wo_version = 6
  depends_on = [
    genesyscloud_oauth_client.client1
  ]
}

I use 1.68.3 provider version

Hi @Ihor Hordiienko

• Use directory_client_secret attribute

Hope this helps

Thanks

Hemanth

------------------------------
Hemanth Dogiparthi
Manager, Software Engineering

Original Message:
Sent: 09-03-2025 11:36
From: Ihor Hordiienko
Subject: Cannot retrieve oauth client secret

Hi Hemanth,

the attribute directory_client_secret just puts a secret into a file on a disk. What I am trying to do is to save it into a proper secret manager.

------------------------------
Ihor Hordiienko
Genesys Engineer

Original Message:
Sent: 09-03-2025 09:29
From: Venkata Hemanth Dogiparthi
Subject: Cannot retrieve oauth client secret

Hi @Ihor Hordiienko

You can follow the blog here https://developer.genesys.cloud/blog/oath-client-secret-CXasCode/ for accessing clientid and clientsecret via cxAsCode.

we have introduced new attribute directory_client_secret in genesyscloud_oauth_client resource which you can use to dump your client credential information. More details in the blog for reference.

Thanks

Hemanth

------------------------------
Hemanth Dogiparthi
Manager, Software Engineering

Original Message:
Sent: 09-02-2025 12:33
From: Ihor Hordiienko
Subject: Cannot retrieve oauth client secret

I am trying to save a clientId and clientsecret. Here is my tf code which seems to be set up right per Genesys' documentation but the value for the id and secret keep coming back null.

{ "client-dev": "{\"client_id\":null,\"client_secret\":null,\"version\":\"5\"}" }

resource "genesyscloud_oauth_client" "client1" {
  name                          = "client1"
  description                   = "TF managed"
  access_token_validity_seconds = 86400
  authorized_grant_type         = "CLIENT-CREDENTIALS"

  roles {
    role_id     = data.genesyscloud_auth_role.admin.id
    division_id = "*"
  }
}

output "client_id" {
  value       = genesyscloud_oauth_client.client1.client_id
  description = "new client id"
}

module "client_oauth_creds" {
  source  = "xxx"
  version = "~> 1.0"

  # name of the secret in a hierarhcy path based standard format
  name = "/secret-lair/classic/terraform-genesyscloud/production/client-dev"

  content_wo = jsonencode({
    "client_id"     = genesyscloud_oauth_client.client1.client_id
    "client_secret" = genesyscloud_oauth_client.client1.client_secret
    "version"       = "6"
  })

  # update this when you want to actually update content in the secret object
  # so that terraform doesn't store the secret in state.
  content_wo_version = 6
  depends_on = [
    genesyscloud_oauth_client.client1
  ]
}

I use 1.68.3 provider version

#CXasCode

------------------------------
Ihor Hordiienko
Genesys Engineer
------------------------------