> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # HCP Terraform > Connect HCP Terraform to inspect workspaces and recent runs, with approval-gated workspace controls Connect HCP Terraform to CloudThinker to inventory workspaces, review recent run status, and make approved workspace changes. This connection uses an organization token for one HCP Terraform organization. ## Prerequisites * An HCP Terraform organization containing the workspaces you want to inspect. * The organization name shown in HCP Terraform. * An organization owner who can create or revoke the organization's API token. An organization token has authority across its HCP Terraform organization. CloudThinker limits its own actions to the capabilities on this page, but you should still treat the token as an organization-wide secret. ## Setup Sign in to [HCP Terraform](https://app.terraform.io/), then select the organization you want to connect from the sidebar. Copy its organization name. Open **Organization settings → API Token**. Under **Organization Tokens**, use the displayed controls to generate the organization token, then copy it immediately. Only organization owners can generate or revoke this single organization-wide token. Before creating or rotating it, coordinate with the organization owners and any existing automations that use it. Navigate to **Connections → HCP Terraform** and enter: * **Organization name**: the name of the organization you selected * **Organization token**: the token you just created Click **Connect**. CloudThinker verifies the organization and shows a **Connected** status. HCP Terraform displays a token only when you create it. Store it securely before leaving the page. Creating or revoking the organization's token can affect other automations that use it. ## Connection details | Field | Description | Example | | ---------------------- | ------------------------------------------------------------------------------------------------- | --------------- | | **Organization name** | The organization name shown in HCP Terraform. Do not enter its URL or HCP organization ID. | `platform-team` | | **Organization token** | The organization token created under **Organization settings → API Token → Organization Tokens**. | — | ## Required permissions Use this organization's **single organization token**, not a personal or team token. Only an organization owner can generate or revoke it. HCP Terraform organization tokens can manage organization-level resources but cannot start runs or create configuration versions. Use the existing organization token when the organization already has one. Before creating or rotating it, coordinate with the organization owners and existing automations. The token has organization-wide authority even though CloudThinker exposes only the bounded workspace actions below. ## Agent capabilities | Capability | Description | | ----------------------- | --------------------------------------------------------------------------------------------- | | **Workspace inventory** | List a bounded set of workspaces and inspect their names, lock state, and workspace settings. | | **Recent run status** | Review a bounded set of recent run statuses. Run status is not infrastructure health. | | **Workspace controls** | Create, rename, lock, unlock, or safely delete an empty workspace after visible approval. | Workspace inventory and recent run status are read-only. Before creating, renaming, locking, unlocking, or safely deleting a workspace, CloudThinker asks for a separate visible approval for that action. ### Limits This connection cannot start plans, applies, or runs. It cannot upload or download configuration or state, change variables, show sensitive outputs, force unlock or force delete a workspace, delete an organization, administer teams or tokens, or connect to Terraform Enterprise custom endpoints. ### Verify the connection ```text theme={null} @alex list my HCP Terraform workspaces and their locked status ``` ### Example prompts ```text theme={null} @alex summarize recent HCP Terraform run statuses by workspace @alex create an empty HCP Terraform workspace named staging-empty and ask for approval first @alex safely delete the empty HCP Terraform workspace named staging-empty and ask for approval first ``` ## Troubleshooting Enter the organization name shown in HCP Terraform. Do not paste the organization URL or an HCP organization ID. Create a replacement organization token if the current one is expired or no longer valid, then update **Organization token** and reconnect. Check that **Organization name** and **Organization token** belong to the same HCP Terraform organization, then reconnect. The token belongs to a different organization than the one entered in **Organization name**. Enter the matching organization name or use that organization's token. Wait and reconnect later. Do not repeatedly retry the connection while HCP Terraform is rate limiting requests. HCP Terraform could not complete the verification. Retry later; the connection does not treat this as a successful result. For safe deletion, this can mean the workspace still manages resources. CloudThinker does not force-delete it. Keep the workspace until it is empty, and unlock it before an allowed workspace change if needed. ## Security * **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later. * **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection. * **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection. * **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves. - **Set and track expiration** — HCP Terraform tokens expire, and you cannot change an expiration after creation. Choose the shortest duration your policy permits and replace the token before it expires. - **Coordinate rotation** — only one organization token is valid at a time. Confirm which integrations use it before you generate or revoke a token. ## Related Review how CloudThinker asks before a workspace change. Connect another infrastructure-management service.