Terraform

Manage StitchDB projects, webhooks, log drains, network restrictions, Auth settings and function secrets as code with Terraform or OpenTofu.

The StitchDB provider describes your projects and their settings in Terraform (or OpenTofu) files, so environments are reviewed in pull requests and rebuilt with one command. It uses the Management API with an organization token.

#Set up

Create an organization token under Organization › API tokens with the scopes your configuration needs (projects:write to create projects and read their keys, webhooks:write, secrets:write, auth:write) and put it in STITCHDB_TOKEN.

Terraform

terraform {
  required_providers {
    stitchdb = { source = "stitchdb/stitchdb", version = "~> 0.1" }
  }
}

provider "stitchdb" {}   # token from STITCHDB_TOKEN

#A project with its settings

Terraform

resource "stitchdb_project" "app" {
  name   = "shop-staging"
  region = "eu-central"
  labels = { env = "staging" }
  limits = { db_size_mb = 2048 }

  # Optional: start from production's schema with masked data
  template = { from_project = "abcdefghijklmnop", data = "masked" }
}

resource "stitchdb_auth_config" "app" {
  project_ref    = stitchdb_project.app.ref
  site_url       = "https://staging.shop.example"
  uri_allow_list = ["https://staging.shop.example/**"]
  jwt_exp        = 3600
}

resource "stitchdb_network_restrictions" "db" {
  project_ref = stitchdb_project.app.ref
  allowlist   = ["203.0.113.7", "198.51.100.0/24"]
}

resource "stitchdb_function_secret" "stripe" {
  project_ref = stitchdb_project.app.ref
  name        = "STRIPE_KEY"
  value       = var.stripe_key
}

output "api_url"  { value = stitchdb_project.app.api_url }
output "anon_key" { value = stitchdb_project.app.anon_key }

terraform apply waits until the project is ready and, with a template, until its schema and data are copied in. service_key and db_password are marked sensitive; keep your state in an encrypted backend.

#Resources

Resource	What it manages	Import ID
`stitchdb_project`	Name, region, labels, limits, template; exposes the API URL, keys and database connection. Changing the region or organization replaces the project.	`<ref>`
`stitchdb_webhook`	An organization webhook endpoint; `secret` holds the signing secret.	`<organization id>/<id>`
`stitchdb_log_drain`	A log drain (`http`, `datadog` or `loki`), its sources and minimum level.	`<ref>/<id>`
`stitchdb_network_restrictions`	IPv4 addresses and ranges allowed to connect to Postgres. Destroying it opens the database to every address again.	`<ref>`
`stitchdb_auth_config`	Auth settings you list (site URL, redirect URLs, sign-up, sessions, passwords, MFA). Settings you leave out keep their dashboard value; destroying it changes nothing.	`<ref>`
`stitchdb_function_secret`	One Edge Function secret. A value changed elsewhere shows up in the next plan (by its digest) and is written back.	`<ref>/<NAME>`

Data sources: stitchdb_organizations (the organizations the token reaches) and stitchdb_project (an existing project by ref, with the same attributes as the resource).

#Bring existing projects in

Terminal

terraform import stitchdb_project.app abcdefghijklmnop
terraform import stitchdb_webhook.alerts <organization-id>/<webhook-id>

#Settings

Provider setting	Environment variable	Default
`token`	`STITCHDB_TOKEN`	(required)
`api_url`	`STITCHDB_API_URL`	`https://stitchdb.com/platform/v1`

Rate limits (429) and brief server errors are retried with backoff. Errors show the API message, for example a missing scope or a plan limit.