PPlatformAppStores

Terraform Registry

Developer Tools

HashiCorp · Developer tools & code hosting

Best for: Distributing Terraform providers and reusable modules to the HashiCorp/OpenTofu ecosystem.

Overview

The Terraform Registry is HashiCorp's public catalog of providers and modules — the reusable building blocks the Terraform engine downloads to provision and manage infrastructure. Providers are plugins that map Terraform's configuration language onto real APIs (AWS, Azure, GCP, Cloudflare, Kubernetes, and hundreds more), while modules package reusable configurations. Consumers need no authentication to discover and pull content; the registry is wired directly into terraform init.

Publishing is self-service but disciplined: authors sign in with a GitHub account, connect a tagged release repository, and — for providers — must supply a GPG public key because every provider release must be cryptographically signed. This signing requirement is the registry's core trust mechanism. On top of open publishing, HashiCorp runs a Provider Development Program that awards a Partner badge to providers and modules from vendors that complete a formal onboarding and review. There is no monetization layer — the public registry is entirely free, with no listing fees, commissions, or merchant-of-record role.

How to build & ship

  1. 1Build a provider (Go, typically with the Terraform Plugin Framework) or author a module
  2. 2Host the source in a public GitHub repo named terraform-provider-NAME (or terraform-MODULE)
  3. 3Generate a GPG signing key and add its public key to your Registry account
  4. 4Tag a semver release and build artifacts (SHA256SUMS + .sig + per-platform binaries) with GoReleaser
  5. 5Sign the checksums file with GPG so Terraform can verify downloads
  6. 6Connect the repo and publish via the Terraform Registry, which ingests tagged GitHub releases

Key APIs & SDKs

Terraform Plugin Framework / Plugin SDKv2
Provider registry protocol
Module registry protocol
GoReleaser (release artifact + signing)
GPG signing (SHA256SUMS.sig)
Terraform Registry HTTP API

Integration types

Connector

Authentication & security

  • Primary auth: None
  • Also supports: OAuth 2.0
  • Security review: Not required
  • Public providers/modules are self-service (with mandatory GPG release signing); the Partner badge requires a formal onboarding and review.
  • The public registry has no manual approval; providers/modules must meet naming, repo, and GPG-signing requirements and publish automatically from GitHub release tags, with signature verification enforced at install time.
  • Registry HTTP API limits are not publicly published as fixed numbers.
Auth docs Store policies

Monetization

Free
Onboarding
$0
Commission
0%
Merchant of Record
None

Pros & cons for builders

Pros

  • Native integration with terraform init and version constraints
  • Automated, tag-driven publishing straight from GitHub releases
  • GPG signing gives users cryptographic verification of provider binaries
  • Free public hosting with auto-generated docs from repo content

Cons

  • Strict repo naming and release-artifact/signing requirements to publish
  • No pre-publication vetting of provider behavior or security
  • Public registry ties providers/modules to GitHub-hosted source

Frequently asked questions

How do I get my app approved on Terraform Registry?

The public registry has no manual approval; providers/modules must meet naming, repo, and GPG-signing requirements and publish automatically from GitHub release tags, with signature verification enforced at install time.

What authentication does Terraform Registry use?

Terraform Registry apps primarily authenticate with None, also supporting OAuth 2.0.

How is Terraform Registry monetized?

Terraform Registry supports Free. Typical commission: 0%. Onboarding fee: $0.

Is a security review required to list on Terraform Registry?

No, Terraform Registry does not require a formal security review before listing.