A deployment pipeline authenticates to HCP Terraform with a user API token that belongs to a senior engineer who is leaving the company next month. What should replace it?
Select an answer to reveal the explanation.
Short Explanation
A personal token in your pipeline is like running the company van on someone's personal insurance: it works until they leave. Team tokens belong to a team, not a person, so they survive staff changes and carry only that team's permissions. Handing over another person's token just schedules the next outage.
Full Explanation
User API tokens act with every permission of the user who created them, across all teams that user belongs to, and they stop working when the account is removed. For automation HashiCorp recommends team tokens: they authenticate as the team's synthetic service account, carry only the permissions granted to that team, and keep working regardless of who joins or leaves. Creating a dedicated team with access to just the pipeline's workspaces, and giving its token an expiration date, limits both the blast radius and the lifetime of the credential. The organization token is meant for initial setup of workspaces and teams; HashiCorp does not recommend it as a general automation interface, and each organization can have only one. Moving to another person's user token repeats the original problem with a new name and likely broader rights. Agent tokens register agents in an agent pool so they can execute runs; they are not API credentials for queuing runs or reading state. Exam caveat: some features that require a personal OAuth flow, such as connecting certain VCS repositories, still need a user, so plan those steps separately. Operational check: switch the pipeline to the team token, revoke the user token, and confirm the next run succeeds.