# Credentials

Credential values remain in GitHub organization secrets. Terraform never reads or stores their values.

## GitHub root credentials

| Secret                              | Consumer               | Purpose                                          |
| ----------------------------------- | ---------------------- | ------------------------------------------------ |
| TF\_GITHUB\_PLAN\_TOKEN             | terraform-github-plan  | Read organization configuration and create plans |
| TF\_GITHUB\_APPLY\_TOKEN            | terraform-github-apply | Apply reviewed organization configuration        |
| CLOUDFLARE\_R2\_ACCESS\_KEY\_ID     | Terraform jobs         | Read, write, and lock remote state               |
| CLOUDFLARE\_R2\_SECRET\_ACCESS\_KEY | Terraform jobs         | Authenticate remote state operations             |

The plan and apply secrets are restricted to the `infrastructure` repository. Apply environments accept only the ` main` branch.

## Local validation

Local validation does not require provider or R2 credentials. `make verify` initializes Terraform without the remote backend, validates configuration, and runs TFLint.