From 25f85829599119d947537be22c66eccd0c1a942c Mon Sep 17 00:00:00 2001
From: Adrian Lai <adrian.lai@jetstack.io>
Date: Tue, 4 Nov 2025 19:50:32 +0000
Subject: [PATCH] Support supplying API key via env

---
 docs/index.md                 |  5 +----
 internal/provider/provider.go | 16 +++++++++++++---
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/docs/index.md b/docs/index.md
index eecc834..5d1e244 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -33,10 +33,7 @@ provider "tlspc" {
 <!-- schema generated by tfplugindocs -->
 ## Schema
 
-### Required
-
-- `apikey` (String) API Key
-
 ### Optional
 
+- `apikey` (String) API Key. Required unless specified by setting the environment variable `TLSPC_APIKEY`
 - `endpoint` (String) TLSPC API Endpoint
diff --git a/internal/provider/provider.go b/internal/provider/provider.go
index eb309f7..1241f29 100644
--- a/internal/provider/provider.go
+++ b/internal/provider/provider.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/function"
+	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/provider"
 	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
@@ -55,9 +56,8 @@ We recommend that you create a custom user with the [permissions required](https
 		Description: "Provider for the Venafi TLS Protect Cloud Platform",
 		Attributes: map[string]schema.Attribute{
 			"apikey": schema.StringAttribute{
-				MarkdownDescription: "API Key",
-				Optional:            false,
-				Required:            true,
+				MarkdownDescription: "API Key. Required unless specified by setting the environment variable `TLSPC_APIKEY`",
+				Optional:            true,
 			},
 			"endpoint": schema.StringAttribute{
 				MarkdownDescription: "TLSPC API Endpoint",
@@ -81,9 +81,19 @@ func (p *tlspcProvider) Configure(ctx context.Context, req provider.ConfigureReq
 	if !config.ApiKey.IsNull() {
 		apikey = config.ApiKey.ValueString()
 	}
+	if apikey == "" {
+		resp.Diagnostics.AddAttributeError(
+			path.Root("apikey"),
+			"API Key not provided",
+			"The provider cannot create the TLSPC API client as the API Key has not been provided",
+		)
+	}
 	if !config.Endpoint.IsNull() {
 		endpoint = config.Endpoint.ValueString()
 	}
+	if resp.Diagnostics.HasError() {
+		return
+	}
 
 	client, _ := tlspc.NewClient(apikey, endpoint, p.version)