Terraform Cloud Token Helper (save into macOS keychain)

.terraformrc

disable_checkpoint = true

credentials_helper helper {
  args = []
}

# save this in home.

terraform-credentials-helper_v1.0.0

#!/bin/sh

set -e

case $1 in
  store)
  security add-generic-password -U -a "TF-$USER" -c "htfm" -C "htfm" -D "Hashicorp Terraform" -s "$2" -w "$(jq -r .token)"
  ;;
  get)
  /bin/echo -n "{\"token\": \"$(security find-generic-password -g -a "TF-$USER" -s "$2" -w)\"}"
  ;;
  forget)
  security delete-generic-password -a "TF-$USER" -s "$2"
  ;;
  *)
  echo "Usage: $0 get|forget|store"
  ;;
esac

# save this into your ~/.terraform.d/plugins/ folder.

and the API changed.... terraform-credentials-credstore --host=credstore.example.com store app.terraform.io for example.

The API is unchanged. Optional flags can be included before get/store/forget.

updated gist to use JQ to extract the token during the store action.
Read: I hadn't tested terraform login with it before.