Terraform Cloud tokens

• Provider documentation HCP Terraform/Enterprise 14+67-byte API token · observed 2026-09-21 · three independent HCP Terraform API-reference pages (user-tokens, organization-tokens, team-tokens) each publish a full example token; every one of the three is exactly 14 bytes before the literal .atlasv1. marker and exactly 67 bytes after it, and the mirrored Terraform Enterprise organization-tokens page publishes the identical shape and example, confirming Cloud and Enterprise are one grammar rather than two. Neither page documents a checksum or any marker beyond the literal .atlasv1. tag
• trufflehog 3.97.4
• gitleaks 8.30.1

Two independently maintained tools recognize the family without agreeing with each other on the exact width: gitleaks 8.30.1's hashicorp-tf-api-token/hashicorp-tf-password rules use a looser 60-70-byte range over a wider [A-Za-z0-9_=-] tail alphabet, while trufflehog 3.97.4's terraformcloudpersonaltoken detector matches all three official examples exactly at the 14/67 width. This contract freezes the tighter, provider-confirmed exact width (matching trufflehog, not gitleaks' looser range) over the looser single-tool range, per the precedent already set for provider-backed exact-width contracts. HashiCorp's own documentation shows one identical grammar for user, organization, team, agent-pool and self-hosted Enterprise tokens, so one shape covers the full family with no branching logic. A malformed marker, a one-byte-short segment, or the documentation's own doc-style placeholder (xxxxxx.atlasv1.zzzzzzzzzzzzz, itself far short of the documented 14/67 widths) is a documented false negative rather than a fuzzy match.