<p>I have a CI/CD pipeline triggered by GitHub Actions which should run Terraform, via Terraform Cloud, and create a Supabase project. Everything works when I hardcode my Supabase access token into my Terraform configuration. I obviously don't want to do that.</p>
<p>My Supabase access token is stored as a GitHub repo secret. My plan was to write the secret into a file during the GitHub Action and have my Terraform configuration refer to the newly created file. However, when doing this Supabase throws the following error:</p>
<pre><code>Unable to create project, got error: Post \&quot;https://api.supabase.com/v1/projects\&quot;: net/http: invalid header field value for \&quot;Authorization\&quot;&quot;
</code></pre>
<p>This is the same error as I get when I deliberately hard code an incorrect access token.</p>
<p>The following is my intended workflow:</p>
<h3>Directory layout</h3>
<pre><code>project
    .github
        workflows
            deploy-production.yml
    supabase
        main.tf
</code></pre>
<h3>main.tf</h3>
<pre class="lang-none prettyprint-override"><code>terraform {
    required_version = &quot;~&gt; 1.9&quot;

    required_providers {
        supabase = {
            source  = &quot;supabase/supabase&quot;
            version = &quot;~&gt; 1.0&quot;
        }
    }
}

provider &quot;supabase&quot; {
    access_token = file(&quot;${path.module}/supabase-access-token&quot;)
}

resource &quot;supabase_project&quot; &quot;production&quot; {
    organization_id   = &quot;***&quot;
    name              = &quot;***&quot;
    database_password = &quot;***&quot;
    region            = &quot;eu-west-2&quot;
}
</code></pre>
<h3>deploy-production.yml</h3>
<pre class="lang-yaml prettyprint-override"><code>name: Deploy Production

env:
    TF_API_TOKEN: ${{ secrets.HCP_TERRAFORM_TOKEN }}
    TF_CLOUD_ORGANIZATION: &quot;***&quot;
    TF_WORKSPACE: &quot;***&quot;
    CONFIG_DIRECTORY: &quot;./supabase&quot;

on:
    push:
        branches:
          - main

jobs:
    update-supabase-production:
        name: Update Supabase Production
        runs-on: ubuntu-latest
        steps:
          - name: Checkout code
            uses: actions/checkout@v4
          - run: 'echo &quot;$SUPABASE_TOKEN&quot; &gt; ./supabase/supabase-access-token'
            shell: bash
            env:
                SUPABASE_TOKEN: ${{ secrets.SUPABASE_TOKEN }}
          - run: 'cat ./supabase/supabase-access-token'
          - name: Upload Terraform Configuration to HCP Terraform
            uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.0
            id: upload-configuration
            with:
                workspace: ${{ env.TF_WORKSPACE }}
                directory: ${{ env.CONFIG_DIRECTORY }}
          - name: Create Terraform Plan
            uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.0
            id: create-plan
            with:
                workspace: ${{ env.TF_WORKSPACE }}
                configuration_version: ${{ steps.upload-configuration.outputs.configuration_version_id }}
          - name: Apply Terraform Plan
            uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.0.0
            id: apply-plan
            if: fromJSON(steps.create-plan.outputs.payload).data.attributes.actions.IsConfirmable
            with:
                run: ${{ steps.create-plan.outputs.run_id }}

</code></pre>
<h2>Validation steps</h2>
<p>Terraform seems to find the file - if I change the path in <code>main.tf</code> then I get an explicit error.</p>
<p>The <code>cat</code> step shows <code>***</code> in the GitHub Actions as you'd expect. I have verified that it reports sensible values if I write a non-secret to the file.</p>
<h2>So...</h2>
<p>I'm out of ideas. What am I missing? Guidance would be very much appreciated!</p>

CC BY-SA 4.0
2024-10-20T05:34:35.470Z
> This is the same error as I get when I deliberately hard code an incorrect access token.
I'd wager you found the problem here - it seems like the token in your github actions secret is incorrect.
Bruce Becker
CC BY-SA 4.0
2024-10-24T22:58:58.337Z
If Terraform itself were failing to read that file then you'd see a different error message from [Terraform's `file` function](https://developer.hashicorp.com/terraform/language/functions/file). The error you included seems to be generated by the "supabase" provider rather than by Terraform itself, and so I expect that either the provider itself is buggy (sending an invalid `Authorization` header value) or your file contains an invalid value for `access_token` which the provider isn't properly validating, and so the remote API is rejecting it even though the provider accepted it.
Martin Atkins
CC BY-SA 4.0
2024-10-24T23:00:29.083Z
The provider seems to literally just concatenate whatever you assign to `access_token` onto the end of the `Authorization` header value: https://github.com/supabase/terraform-provider-supabase/blob/20a3696cc0ce1a101ff621ec77913fa1501d44f0/internal/provider/provider.go#L78 ... so it seems like whatever content you have in that file is not valid syntax as far as the remote API is concerned.
Martin Atkins
CC BY-SA 4.0
2024-10-24T23:02:02.500Z
My "psychic debugging" guess would be: your `supabase-access-token` file ends with a newline character and so you're effectively sending that newline character as part of the `Authorization` header and so the API is rejecting it as invalid. If that _is_ what's happening then you could pass the result of the `file` function through [`chomp`](https://developer.hashicorp.com/terraform/language/functions/chomp) to trim the newlines from the end.
Martin Atkins
<terraform><github-actions>
Why is my Terraform configuration not loading credentials from file?
Pete
# Why is my Terraform configuration not loading credentials from file?

(Asked by: username_0 on 2024-10-17)

I have a CI/CD pipeline triggered by GitHub Actions which should run Terraform, via Terraform Cloud, and create a Supabase project. Everything works when I hardcode my Supabase access token into my Terraform configuration. I obviously don't want to do that.
My Supabase access token is stored as a GitHub repo secret. My plan was to write the secret into a file during the GitHub Action and have my Terraform configuration refer to the newly created file. However, when doing this Supabase throws the following error:
Unable to create project, got error: Post \"https://api.supabase.com/v1/projects\": net/http: invalid header field value for \"Authorization\""

This is the same error as I get when I deliberately hard code an incorrect access token.
The following is my intended workflow:
Directory layout
project
    .github
        workflows
            deploy-production.yml
    supabase
        main.tf

main.tf
terraform {
    required_version = "~> 1.9"

    required_providers {
        supabase = {
            source  = "supabase/supabase"
            version = "~> 1.0"
        }
    }
}

provider "supabase" {
    access_token = file("${path.module}/supabase-access-token")
}

resource "supabase_project" "production" {
    organization_id   = "***"
    name              = "***"
    database_password = "***"
    region            = "eu-west-2"
}

deploy-production.yml
name: Deploy Production

env:
    TF_API_TOKEN: ${{ secrets.HCP_TERRAFORM_TOKEN }}
    TF_CLOUD_ORGANIZATION: "***"
    TF_WORKSPACE: "***"
    CONFIG_DIRECTORY: "./supabase"

on:
    push:
        branches:
          - main

jobs:
    update-supabase-production:
        name: Update Supabase Production
        runs-on: ubuntu-latest
        steps:
          - name: Checkout code
            uses: actions/checkout@v4
          - run: 'echo "$SUPABASE_TOKEN" > ./supabase/supabase-access-token'
            shell: bash
            env:
                SUPABASE_TOKEN: ${{ secrets.SUPABASE_TOKEN }}
          - run: 'cat ./supabase/supabase-access-token'
          - name: Upload Terraform Configuration to HCP Terraform
            uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.0
            id: upload-configuration
            with:
                workspace: ${{ env.TF_WORKSPACE }}
                directory: ${{ env.CONFIG_DIRECTORY }}
          - name: Create Terraform Plan
            uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.0
            id: create-plan
            with:
                workspace: ${{ env.TF_WORKSPACE }}
                configuration_version: ${{ steps.upload-configuration.outputs.configuration_version_id }}
          - name: Apply Terraform Plan
            uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.0.0
            id: apply-plan
            if: fromJSON(steps.create-plan.outputs.payload).data.attributes.actions.IsConfirmable
            with:
                run: ${{ steps.create-plan.outputs.run_id }}


Validation steps
Terraform seems to find the file - if I change the path in main.tf then I get an explicit error.
The cat step shows *** in the GitHub Actions as you'd expect. I have verified that it reports sensible values if I write a non-secret to the file.
So...
I'm out of ideas. What am I missing? Guidance would be very much appreciated!

**Tags:** terraform, github-actions

> **Comments:**
> **username_1**: > This is the same error as I get when I deliberately hard code an incorrect access token. I'd wager you found the problem here - it seems like the token in your github actions secret is incorrect.  
> **username_2**: If Terraform itself were failing to read that file then you'd see a different error message from [Terraform's `file` function](https://developer.hashicorp.com/terraform/language/functions/file). The error you included seems to be generated by the "supabase" provider rather than by Terraform itself, and so I expect that either the provider itself is buggy (sending an invalid `Authorization` header value) or your file contains an invalid value for `access_token` which the provider isn't properly validating, and so the remote API is rejecting it even though the provider accepted it.  
> **username_2**: The provider seems to literally just concatenate whatever you assign to `access_token` onto the end of the `Authorization` header value: https://github.com/supabase/terraform-provider-supabase/blob/20a3696cc0ce1a101ff621ec77913fa1501d44f0/internal/provider/provider.go#L78 ... so it seems like whatever content you have in that file is not valid syntax as far as the remote API is concerned.  
> **username_2**: My "psychic debugging" guess would be: your `supabase-access-token` file ends with a newline character and so you're effectively sending that newline character as part of the `Authorization` header and so the API is rejecting it as invalid. If that _is_ what's happening then you could pass the result of the `file` function through [`chomp`](https://developer.hashicorp.com/terraform/language/functions/chomp) to trim the newlines from the end.  

---

## 0 answers

