Hi all,
I searched in the discussions but couldn’t find the answer.
I need to access 2 complete different accounts from app.terraform.io (2 companies that have nothing to do between them) and I’m need also sometimes to use the Terraform CLI.
I couldn’t find a way to configure both tokens on my laptop: is there any way to do it using the .terraformc or ~/.terraform.d/credentials.tfrc.json CLI configuration files?
Thx!
Hi @cloudmaniac,
The credentials model for Terraform is one set of credentials per hostname, so there’s no built in way to select different credentials per account. Indeed, the credentials used dictate which accounts you have access to, rather than the other way around.
What you could do, though, is to set the TF_CLI_CONFIG_FILE environment variable to point to some other file, which Terraform will then use instead of ~/.terraformrc as the initial configuration file.
(Terraform will still read and use the files in ~/.terraform.d, so to use this approach you’ll need to make sure there are no credentials "app.terraform.io" { ... } blocks in those files that would otherwise conflict with your new separate file.)
I see, that’s what I was afraid of. 
I’ll see how I can handle that long term.
Thx for the answer!
@cloudmaniac I ran into the same problem. Did you go with TF_CLI_CONFIG_FILE or did you figure out another solution?
I used the TF_CLI_CONFIG_FILE as I had to move on.
Hi @apparentlymart,
Any news regarding this issue? It’s 4 years already!
I’ve thought about using credential helpers, but I can’t say I fully understand how that would help
Another way, I guess, is just to use TF_TOKEN_app_terraform_io and even take it from 1Password or smth, but it’s an extra step
Since this thread still gets visits years later (hi @delaskoff 
— the credentials-helper question at the end is exactly what this reply is about), here’s an update on that angle.
@apparentlymart’s TF_CLI_CONFIG_FILE workaround solves which config file Terraform reads, but each config still ends up holding its own plain-text token. A credentials helper closes the remaining gap: the per-account config selects a profile, and the helper fetches the right token from isolated secret storage.
Full disclosure — I ran into this exact scenario freelancing across client TFC accounts on one laptop, and ended up building tfvault for it. It composes the two mechanisms:
hcl
credentials_helper “tfvault” {
args = [“–profile”, “client-a”]
}
profiles:
client-a:
backend: keyring # or pass/gopass, env
options:
service: tfvault-client-a
client-b:
backend: keyring
options:
service: tfvault-client-b
Same hostname (app.terraform.io), different tokens, each in its own OS-keyring entry. terraform login / logout keep working per profile, and nothing lands in plain text.
For completeness: since Terraform 1.2 you can also skip helpers entirely with TF_TOKEN_app_terraform_io environment variables — which pairs nicely with the 1Password approach you mentioned (op run) and fits CI well. The helper approach mainly shines for interactive use, where you want terraform login to keep working and tokens to live in a real secret store.
Hope that helps someone who lands here!