This message was deleted.

I think it makes more sense that this would be an input of your provider, no?

I could for one provider, but if I had a number of providers for one service denoting different resources, it's a little unwieldy to keep providing an access key to every resource. I believe other projects just bypassed Pulumi configurations and opted to use environment variables, guess I should emulate that.

yea that would be the only other route. You could write it like an AWS provider, where it defaults to environment variables / implied auth and any provided inputs simply overwrite the defaults.