How to fix Error: Required token could not be found in Terraform

Visit Terraform Cloud (https://app.terraform.io), sign in, and create a new API token:

1. Click your profile icon (top right) → Account settings
2. Navigate to "Tokens"
3. Click "Create an API token"
4. Give it a descriptive name (e.g., "Local dev" or "CI/CD")
5. Choose appropriate scope (usually "Full access")
6. Click "Generate token"
7. Copy the token immediately — it is only displayed once

Save the token to a text editor temporarily. Do not lose it; you'll need it in the next steps.

The simplest method for local development is the terraform login command:

terraform login

Terraform will:
1. Prompt: "Do you want to copy these credentials to the local credentials file? (yes/no)"
2. Open a browser to app.terraform.io to create a token (if not already done)
3. Ask you to paste the token back into the terminal
4. Automatically save credentials to ~/.terraform.d/credentials.tfrc.json

After this, terraform init and other commands should work. Verify:

terraform init

If terraform login is unavailable or non-interactive (common in CI/CD), manually create the credentials file:

mkdir -p ~/.terraform.d

Create ~/.terraform.d/credentials.tfrc.json:

{
  "credentials": {
    "app.terraform.io": {
      "token": "YOUR_API_TOKEN_HERE"
    }
  }
}

Replace YOUR_API_TOKEN_HERE with your actual Terraform Cloud API token (from step 1).

Set proper permissions:

chmod 600 ~/.terraform.d/credentials.tfrc.json

Verify the file was created and is readable:

ls -la ~/.terraform.d/credentials.tfrc.json

In automated environments (GitHub Actions, GitLab CI, Jenkins), use the TF_TOKEN_app_terraform_io environment variable instead of file-based credentials:

GitHub Actions example:

jobs:
  terraform:
    runs-on: ubuntu-latest
    env:
      TF_TOKEN_app_terraform_io: ${{ secrets.TERRAFORM_API_TOKEN }}
    steps:
      - uses: actions/checkout@v3
      - uses: hashicorp/setup-terraform@v2
      - run: terraform init
      - run: terraform plan

GitLab CI example:

terraform-plan:
  image: hashicorp/terraform:latest
  variables:
    TF_TOKEN_app_terraform_io: $TERRAFORM_API_TOKEN
  script:
    - terraform init
    - terraform plan

The TF_TOKEN_ prefix combined with hostname (app.terraform.io becomes app_terraform_io) tells Terraform where to use this token. Store the actual token value in your CI/CD platform's secrets management, not in code.

If you installed Terraform via snap, it may look for credentials in the wrong location:

mkdir -p ~/.terraform.d
ln -s ~/.terraformrc ~/.terraform.d/credentials.tfrc.json

If you haven't created ~/.terraformrc yet, first generate it with terraform login, then create the symlink above. Verify the symlink:

ls -la ~/.terraform.d/

You should see:

lrwxrwxrwx credentials.tfrc.json -> ~/.terraformrc

Test that Terraform can now authenticate:

terraform version  # Should not error if credentials are valid

If using a self-hosted Terraform Enterprise or custom backend server (not app.terraform.io), add credentials for that hostname:

{
  "credentials": {
    "app.terraform.io": {
      "token": "YOUR_CLOUD_TOKEN"
    },
    "terraform.example.com": {
      "token": "YOUR_ENTERPRISE_TOKEN"
    }
  }
}

Or via environment variable (replace hostname with underscores):

export TF_TOKEN_terraform_example_com="YOUR_ENTERPRISE_TOKEN"

Then configure your backend block:

terraform {
  cloud {
    hostname = "terraform.example.com"
    organization = "my-org"
  }
}

Verify connectivity:

terraform init