For Okta, Auth0, and Authentik
ClickOps in. Terraform out.
TFsmith turns your identity tenant into hand-written-quality Terraform. Connect with a read-only token, browse every object, and export resource blocks with import blocks included - so your first plan adopts what exists instead of recreating it.
resource "okta_app_saml" "duo_admin_panel" {
label = "Duo Admin Panel"
status = "ACTIVE"
sso_url = "https://sso-abc123.sso.duosecurity.com/saml2/sp/DIRSVC/sso"
audience = "https://sso-abc123.sso.duosecurity.com/saml2/sp/DIRSVC/metadata"
subject_name_id_template = "${user.userName}"
#accessibility_error_redirect_url = ""
}
import {
to = okta_app_saml.duo_admin_panel
id = "0oaim59q48RDNPzik357"
}Official provider schemas · Secrets become sensitive variables, never HCL · Read-only by architecture - it cannot write to your tenant
Terraform your tenant deserves
Import blocks included
Every resource ships with its import block, so your first terraform plan says 'will be imported' - not 'will be created'. Adopt an existing tenant into IaC in one pass instead of hand-running terraform import per object.
Official provider schemas
HCL is generated against the published schemas of the official providers - goauthentik/authentik, okta/okta, auth0/auth0. Identity-first attribute ordering, and unset-but-available fields as aligned commented lines.
Whole-tenant bundles
Pick resource types, download a zip: one .tf per type, provider setup, typed variables, import blocks, and an honest coverage README that lists anything skipped and why.
Cross-references rewritten
Provider-assigned ids never survive a move. When a referenced object is in the same export, the reference becomes a Terraform expression that resolves in the target - promote staging to prod without id surgery.
Secrets never in code
Client secrets, keys, and passwords are never written into HCL. Each becomes a sensitive Terraform variable you supply at plan time from your own secret manager.
Multi-user, flat pricing
The Business tier has unlimited users sharing one install and one refreshed dataset. Roles (admin/user), TOTP MFA, invites, and an audit log built in. No per-seat pricing, ever.
Up and running in four steps
docker compose up
One image plus Postgres. Keys generate themselves on first boot; enter your license and you are in.
Connect read-only
Paste a read-only admin API token. Validated against your provider first, then encrypted at rest. TFsmith cannot write to your tenant.
Browse & refresh
Every exportable object, organized by type. Data is pulled once at connect, then only when you click Refresh - your rate limits stay yours.
Export & adopt
Per-object blocks or a whole-tenant bundle. Run terraform plan: N to import, 0 to add, 0 to destroy is the bar it is built to hit.
Why import blocks change everything
Terraform only manages what is in its state file - and a fresh state
file is empty. Export your tenant without import blocks and your first
terraform plan
tries to CREATE a duplicate of every object.
TFsmith ships an import block with every resource, so that same first
plan says will be imported: your existing objects are adopted
into state, nothing is recreated, and Terraform manages the real thing
from then on. Promoting to a different tenant instead? Delete one file
(import.tf)
and Terraform creates everything fresh - with cross-references already
rewritten as expressions that resolve in the target.
The bar it is built to hit on a real tenant: N to import, 0 to add, 0 to destroy, on the very first plan.
Terraform will perform the following actions:
# okta_app_saml.duo_admin_panel will be imported
# okta_group.slack_users will be imported
# okta_policy_mfa.default will be imported
...
Plan: 365 to import, 0 to add, 0 to change, 0 to destroy.Real output shape from a full-tenant export - every existing object adopted, nothing recreated, nothing destroyed.
Read-only by architecture
TFsmith asks for a read-only admin API token and never needs more. There is no code path that writes to your tenant - not a feature toggle, an architecture. Tokens are validated before storage and encrypted at rest with per-tenant keys wrapped by your install's master key.
And it respects your rate limits: your provider is pulled once when a tenant is connected, then only when someone clicks Refresh. Browsing, reloading, and exporting never touch the provider API - ten users browsing all day cost the same API budget as one.
Self-hosted, private by default
One Docker image plus Postgres, on your hardware. Your tenant data never leaves your network. The only thing TFsmith ever sends us is your license id during activation - never your tenants, never your data, never telemetry. Air-gapped? An offline license file never phones home at all.
Licensing is flat and honest: a tier price and a per-tenant add-on. No per-seat pricing - your IdP bills per user, your tooling should not.
Flat pricing. No per-seat math.
Your IdP bills per user. Your tooling should not.
Individual
$10/mo
+ $5 per additional tenant / month
One user, 2 tenants included. The solo engineer bringing tenants under Terraform.
Business
$20/mo
+ $5 per additional tenant / month
Unlimited users, 2 tenants included. The whole team shares one install and one refreshed dataset.
| Individual | Business | |
|---|---|---|
| Users | 1 | Unlimited |
| Tenants | 2 included, +$5/mo each additional | 2 included, +$5/mo each additional |
| Providers (Okta, Auth0, Authentik) | Yes | Yes |
| Per-object Terraform with import blocks | Yes | Yes |
| Whole-tenant bundle export | Yes | Yes |
| Cross-reference rewriting | Yes | Yes |
| Secrets as sensitive variables (never in HCL) | Yes | Yes |
| Persisted encrypted exports, manual refresh | Yes | Yes |
| Roles (admin / user) | - | Yes |
| Email invites, reset links, TOTP MFA | MFA only | Yes |
| Audit log | Yes | Yes |
| Read-only architecture, no telemetry | Yes | Yes |
Licenses activate against our license server; the only thing ever sent is your
license id - never your tenants, never your data, never telemetry. Renewals and
added tenants apply automatically at the app's daily check-in, no new key needed.
One license runs one install at a time and moves freely between installs.
Air-gapped? Annual licenses can use an offline license file.
Existing customers: add tenants or manage your subscription here.