Body: <p>I have a CI/CD pipeline triggered by GitHub Actions which should run Terraform, via Terraform Cloud, and create a Supabase project. Everything works when I hardcode my Supabase access token into my Terraform configuration. I obviously don't want to do that.</p>
  <p>My Supabase access token is stored as a GitHub repo secret. My plan was to write the secret into a file during the GitHub Action and have my Terraform configuration refer to the newly created file. However, when doing this Supabase throws the following error:</p>
  <pre><code>Unable to create project, got error: Post \&quot;https://api.supabase.com/v1/projects\&quot;: net/http: invalid header field value for \&quot;Authorization\&quot;&quot;
  </code></pre>
  <p>This is the same error as I get when I deliberately hard code an incorrect access token.</p>
  <p>The following is my intended workflow:</p>
  <h3>Directory layout</h3>
  <pre><code>project
      .github
          workflows
              deploy-production.yml
      supabase
          main.tf
  </code></pre>
  <h3>main.tf</h3>
  <pre class="lang-none prettyprint-override"><code>terraform {
      required_version = &quot;~&gt; 1.9&quot;
  
      required_providers {
          supabase = {
              source  = &quot;supabase/supabase&quot;
              version = &quot;~&gt; 1.0&quot;
          }
      }
  }
  
  provider &quot;supabase&quot; {
      access_token = file(&quot;${path.module}/supabase-access-token&quot;)
  }
  
  resource &quot;supabase_project&quot; &quot;production&quot; {
      organization_id   = &quot;***&quot;
      name              = &quot;***&quot;
      database_password = &quot;***&quot;
      region            = &quot;eu-west-2&quot;
  }
  </code></pre>
  <h3>deploy-production.yml</h3>
  <pre class="lang-yaml prettyprint-override"><code>name: Deploy Production
  
  env:
      TF_API_TOKEN: ${{ secrets.HCP_TERRAFORM_TOKEN }}
      TF_CLOUD_ORGANIZATION: &quot;***&quot;
      TF_WORKSPACE: &quot;***&quot;
      CONFIG_DIRECTORY: &quot;./supabase&quot;
  
  on:
      push:
          branches:
            - main
  
  jobs:
      update-supabase-production:
          name: Update Supabase Production
          runs-on: ubuntu-latest
          steps:
            - name: Checkout code
              uses: actions/checkout@v4
            - run: 'echo &quot;$SUPABASE_TOKEN&quot; &gt; ./supabase/supabase-access-token'
              shell: bash
              env:
                  SUPABASE_TOKEN: ${{ secrets.SUPABASE_TOKEN }}
            - run: 'cat ./supabase/supabase-access-token'
            - name: Upload Terraform Configuration to HCP Terraform
              uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.0
              id: upload-configuration
              with:
                  workspace: ${{ env.TF_WORKSPACE }}
                  directory: ${{ env.CONFIG_DIRECTORY }}
            - name: Create Terraform Plan
              uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.0
              id: create-plan
              with:
                  workspace: ${{ env.TF_WORKSPACE }}
                  configuration_version: ${{ steps.upload-configuration.outputs.configuration_version_id }}
            - name: Apply Terraform Plan
              uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.0.0
              id: apply-plan
              if: fromJSON(steps.create-plan.outputs.payload).data.attributes.actions.IsConfirmable
              with:
                  run: ${{ steps.create-plan.outputs.run_id }}
  
  </code></pre>
  <h2>Validation steps</h2>
  <p>Terraform seems to find the file - if I change the path in <code>main.tf</code> then I get an explicit error.</p>
  <p>The <code>cat</code> step shows <code>***</code> in the GitHub Actions as you'd expect. I have verified that it reports sensible values if I write a non-secret to the file.</p>
  <h2>So...</h2>
  <p>I'm out of ideas. What am I missing? Guidance would be very much appreciated!</p>
  
Comments: CC BY-SA 4.0
Comments: 2024-10-20T05:34:35.470Z
Comments: > This is the same error as I get when I deliberately hard code an incorrect access token.
  I'd wager you found the problem here - it seems like the token in your github actions secret is incorrect.
Comments: Bruce Becker
Comments: CC BY-SA 4.0
Comments: 2024-10-24T22:58:58.337Z
Comments: If Terraform itself were failing to read that file then you'd see a different error message from [Terraform's `file` function](https://developer.hashicorp.com/terraform/language/functions/file). The error you included seems to be generated by the "supabase" provider rather than by Terraform itself, and so I expect that either the provider itself is buggy (sending an invalid `Authorization` header value) or your file contains an invalid value for `access_token` which the provider isn't properly validating, and so the remote API is rejecting it even though the provider accepted it.
Comments: Martin Atkins
Comments: CC BY-SA 4.0
Comments: 2024-10-24T23:00:29.083Z
Comments: The provider seems to literally just concatenate whatever you assign to `access_token` onto the end of the `Authorization` header value: https://github.com/supabase/terraform-provider-supabase/blob/20a3696cc0ce1a101ff621ec77913fa1501d44f0/internal/provider/provider.go#L78 ... so it seems like whatever content you have in that file is not valid syntax as far as the remote API is concerned.
Comments: Martin Atkins
Comments: CC BY-SA 4.0
Comments: 2024-10-24T23:02:02.500Z
Comments: My "psychic debugging" guess would be: your `supabase-access-token` file ends with a newline character and so you're effectively sending that newline character as part of the `Authorization` header and so the API is rejecting it as invalid. If that _is_ what's happening then you could pass the result of the `file` function through [`chomp`](https://developer.hashicorp.com/terraform/language/functions/chomp) to trim the newlines from the end.
Comments: Martin Atkins
Tags: <terraform><github-actions>
Title: Why is my Terraform configuration not loading credentials from file?
UserDisplayName: Pete
ThreadText: # Why is my Terraform configuration not loading credentials from file?
  
  (Asked by: username_0 on 2024-10-17)
  
  I have a CI/CD pipeline triggered by GitHub Actions which should run Terraform, via Terraform Cloud, and create a Supabase project. Everything works when I hardcode my Supabase access token into my Terraform configuration. I obviously don't want to do that.
  
  My Supabase access token is stored as a GitHub repo secret. My plan was to write the secret into a file during the GitHub Action and have my Terraform configuration refer to the newly created file. However, when doing this Supabase throws the following error:
  
  ```
  Unable to create project, got error: Post \"https://api.supabase.com/v1/projects\": net/http: invalid header field value for \"Authorization\""
  
  ```
  
  This is the same error as I get when I deliberately hard code an incorrect access token.
  
  The following is my intended workflow:
  
  ### Directory layout
  
  ```
  project
      .github
          workflows
              deploy-production.yml
      supabase
          main.tf
  
  ```
  
  ### main.tf
  
  ```none
  terraform {
      required_version = "~> 1.9"
  
      required_providers {
          supabase = {
              source  = "supabase/supabase"
              version = "~> 1.0"
          }
      }
  }
  
  provider "supabase" {
      access_token = file("${path.module}/supabase-access-token")
  }
  
  resource "supabase_project" "production" {
      organization_id   = "***"
      name              = "***"
      database_password = "***"
      region            = "eu-west-2"
  }
  
  ```
  
  ### deploy-production.yml
  
  ```yaml
  name: Deploy Production
  
  env:
      TF_API_TOKEN: ${{ secrets.HCP_TERRAFORM_TOKEN }}
      TF_CLOUD_ORGANIZATION: "***"
      TF_WORKSPACE: "***"
      CONFIG_DIRECTORY: "./supabase"
  
  on:
      push:
          branches:
            - main
  
  jobs:
      update-supabase-production:
          name: Update Supabase Production
          runs-on: ubuntu-latest
          steps:
            - name: Checkout code
              uses: actions/checkout@v4
            - run: 'echo "$SUPABASE_TOKEN" > ./supabase/supabase-access-token'
              shell: bash
              env:
                  SUPABASE_TOKEN: ${{ secrets.SUPABASE_TOKEN }}
            - run: 'cat ./supabase/supabase-access-token'
            - name: Upload Terraform Configuration to HCP Terraform
              uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.0
              id: upload-configuration
              with:
                  workspace: ${{ env.TF_WORKSPACE }}
                  directory: ${{ env.CONFIG_DIRECTORY }}
            - name: Create Terraform Plan
              uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.0
              id: create-plan
              with:
                  workspace: ${{ env.TF_WORKSPACE }}
                  configuration_version: ${{ steps.upload-configuration.outputs.configuration_version_id }}
            - name: Apply Terraform Plan
              uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.0.0
              id: apply-plan
              if: fromJSON(steps.create-plan.outputs.payload).data.attributes.actions.IsConfirmable
              with:
                  run: ${{ steps.create-plan.outputs.run_id }}
  
  ```
  
  ## Validation steps
  
  Terraform seems to find the file - if I change the path in `main.tf` then I get an explicit error.
  
  The `cat` step shows `***` in the GitHub Actions as you'd expect. I have verified that it reports sensible values if I write a non-secret to the file.
  
  ## So...
  
  I'm out of ideas. What am I missing? Guidance would be very much appreciated!
  
  **Tags:** terraform, github-actions
  
  > **Comments:**
  > **username_1**: > This is the same error as I get when I deliberately hard code an incorrect access token. I'd wager you found the problem here - it seems like the token in your github actions secret is incorrect.  
  > **username_2**: If Terraform itself were failing to read that file then you'd see a different error message from [Terraform's `file` function](https://developer.hashicorp.com/terraform/language/functions/file). The error you included seems to be generated by the "supabase" provider rather than by Terraform itself, and so I expect that either the provider itself is buggy (sending an invalid `Authorization` header value) or your file contains an invalid value for `access_token` which the provider isn't properly validating, and so the remote API is rejecting it even though the provider accepted it.  
  > **username_2**: The provider seems to literally just concatenate whatever you assign to `access_token` onto the end of the `Authorization` header value: https://github.com/supabase/terraform-provider-supabase/blob/20a3696cc0ce1a101ff621ec77913fa1501d44f0/internal/provider/provider.go#L78 ... so it seems like whatever content you have in that file is not valid syntax as far as the remote API is concerned.  
  > **username_2**: My "psychic debugging" guess would be: your `supabase-access-token` file ends with a newline character and so you're effectively sending that newline character as part of the `Authorization` header and so the API is rejecting it as invalid. If that _is_ what's happening then you could pass the result of the `file` function through [`chomp`](https://developer.hashicorp.com/terraform/language/functions/chomp) to trim the newlines from the end.  
  
  ---
  
  ## 0 answers
  
  