diff --git a/provisioner/terraform/resources_test.go b/provisioner/terraform/resources_test.go
index 7ec1887c34f81..7a303096f19cf 100644
--- a/provisioner/terraform/resources_test.go
+++ b/provisioner/terraform/resources_test.go
@@ -66,6 +66,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -84,6 +85,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -103,6 +105,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_InstanceId{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -120,6 +123,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -138,6 +142,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -146,6 +151,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "darwin",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 1,
 					MotdFile:                 "/etc/motd",
 					DisplayApps:              &displayApps,
@@ -162,6 +168,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "windows",
 					Architecture:             "arm64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					TroubleshootingUrl:       "https://coder.com/troubleshoot",
 					DisplayApps:              &displayApps,
@@ -171,6 +178,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -213,6 +221,7 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -240,6 +249,7 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -275,6 +285,7 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -295,6 +306,7 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -320,6 +332,7 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -338,6 +351,7 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -383,6 +397,7 @@ func TestConvertResources(t *testing.T) {
 							},
 						},
 						Auth:                     &proto.Agent_Token{},
+						ApiKeyScope:              "all",
 						ConnectionTimeoutSeconds: 120,
 						DisplayApps:              &displayApps,
 						ResourcesMonitoring: &proto.ResourcesMonitoring{
@@ -398,6 +413,7 @@ func TestConvertResources(t *testing.T) {
 						Architecture:             "amd64",
 						Apps:                     []*proto.App{},
 						Auth:                     &proto.Agent_Token{},
+						ApiKeyScope:              "all",
 						ConnectionTimeoutSeconds: 120,
 						DisplayApps:              &displayApps,
 						ResourcesMonitoring: &proto.ResourcesMonitoring{
@@ -443,6 +459,7 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -462,6 +479,7 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -492,6 +510,7 @@ func TestConvertResources(t *testing.T) {
 				Agents: []*proto.Agent{{
 					Name:            "main",
 					Auth:            &proto.Agent_Token{},
+					ApiKeyScope:     "all",
 					OperatingSystem: "linux",
 					Architecture:    "amd64",
 					Metadata: []*proto.Agent_Metadata{{
@@ -577,6 +596,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "windows",
 					Architecture:             "arm64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -657,6 +677,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "windows",
 					Architecture:             "arm64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -684,6 +705,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "windows",
 					Architecture:             "arm64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -738,6 +760,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -754,6 +777,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps: &proto.DisplayApps{
 						VscodeInsiders: true,
@@ -772,6 +796,7 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &proto.DisplayApps{},
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -786,8 +811,8 @@ func TestConvertResources(t *testing.T) {
 					Name:                     "dev",
 					OperatingSystem:          "windows",
 					Architecture:             "arm64",
-					ApiKeyScope:              "all",
 					Auth:                     &proto.Agent_Token{},
+					ApiKeyScope:              "all",
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
 					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
@@ -847,6 +872,7 @@ func TestConvertResources(t *testing.T) {
 						OperatingSystem:          "linux",
 						Architecture:             "amd64",
 						Auth:                     &proto.Agent_Token{},
+						ApiKeyScope:              "all",
 						ConnectionTimeoutSeconds: 120,
 						DisplayApps:              &displayApps,
 						ResourcesMonitoring:      &proto.ResourcesMonitoring{},
diff --git a/provisioner/terraform/testdata/resources/calling-module/calling-module.tfplan.json b/provisioner/terraform/testdata/resources/calling-module/calling-module.tfplan.json
index e2a0f20b1c625..c2a9e8ac1f644 100644
--- a/provisioner/terraform/testdata/resources/calling-module/calling-module.tfplan.json
+++ b/provisioner/terraform/testdata/resources/calling-module/calling-module.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -84,6 +85,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/calling-module/calling-module.tfstate.json b/provisioner/terraform/testdata/resources/calling-module/calling-module.tfstate.json
index 5baaf2ab4b978..b389cc4d46755 100644
--- a/provisioner/terraform/testdata/resources/calling-module/calling-module.tfstate.json
+++ b/provisioner/terraform/testdata/resources/calling-module/calling-module.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/chaining-resources/chaining-resources.tfplan.json b/provisioner/terraform/testdata/resources/chaining-resources/chaining-resources.tfplan.json
index 01e47405a6384..c77cbb5e46e91 100644
--- a/provisioner/terraform/testdata/resources/chaining-resources/chaining-resources.tfplan.json
+++ b/provisioner/terraform/testdata/resources/chaining-resources/chaining-resources.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -74,6 +75,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/chaining-resources/chaining-resources.tfstate.json b/provisioner/terraform/testdata/resources/chaining-resources/chaining-resources.tfstate.json
index 8f25b435f2e68..e36e03ebc42ab 100644
--- a/provisioner/terraform/testdata/resources/chaining-resources/chaining-resources.tfstate.json
+++ b/provisioner/terraform/testdata/resources/chaining-resources/chaining-resources.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/conflicting-resources/conflicting-resources.tfplan.json b/provisioner/terraform/testdata/resources/conflicting-resources/conflicting-resources.tfplan.json
index 7018070facce2..6926940cfd8bf 100644
--- a/provisioner/terraform/testdata/resources/conflicting-resources/conflicting-resources.tfplan.json
+++ b/provisioner/terraform/testdata/resources/conflicting-resources/conflicting-resources.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -74,6 +75,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/conflicting-resources/conflicting-resources.tfstate.json b/provisioner/terraform/testdata/resources/conflicting-resources/conflicting-resources.tfstate.json
index 3e633ac135573..2160d0d1816a6 100644
--- a/provisioner/terraform/testdata/resources/conflicting-resources/conflicting-resources.tfstate.json
+++ b/provisioner/terraform/testdata/resources/conflicting-resources/conflicting-resources.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/devcontainer/devcontainer.tfplan.json b/provisioner/terraform/testdata/resources/devcontainer/devcontainer.tfplan.json
index eb968dec50922..fc765e999d4bc 100644
--- a/provisioner/terraform/testdata/resources/devcontainer/devcontainer.tfplan.json
+++ b/provisioner/terraform/testdata/resources/devcontainer/devcontainer.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -88,6 +89,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/devcontainer/devcontainer.tfstate.json b/provisioner/terraform/testdata/resources/devcontainer/devcontainer.tfstate.json
index c3768859186ba..a024d46715700 100644
--- a/provisioner/terraform/testdata/resources/devcontainer/devcontainer.tfstate.json
+++ b/provisioner/terraform/testdata/resources/devcontainer/devcontainer.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/display-apps-disabled/display-apps-disabled.tfplan.json b/provisioner/terraform/testdata/resources/display-apps-disabled/display-apps-disabled.tfplan.json
index 523a3bacf3d12..177a13a53a5fd 100644
--- a/provisioner/terraform/testdata/resources/display-apps-disabled/display-apps-disabled.tfplan.json
+++ b/provisioner/terraform/testdata/resources/display-apps-disabled/display-apps-disabled.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -73,6 +74,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/display-apps-disabled/display-apps-disabled.tfstate.json b/provisioner/terraform/testdata/resources/display-apps-disabled/display-apps-disabled.tfstate.json
index 504bb3502be55..a04a50ae6cdf7 100644
--- a/provisioner/terraform/testdata/resources/display-apps-disabled/display-apps-disabled.tfstate.json
+++ b/provisioner/terraform/testdata/resources/display-apps-disabled/display-apps-disabled.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/display-apps/display-apps.tfplan.json b/provisioner/terraform/testdata/resources/display-apps/display-apps.tfplan.json
index bb1694171c575..6d075fff54d98 100644
--- a/provisioner/terraform/testdata/resources/display-apps/display-apps.tfplan.json
+++ b/provisioner/terraform/testdata/resources/display-apps/display-apps.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -73,6 +74,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/display-apps/display-apps.tfstate.json b/provisioner/terraform/testdata/resources/display-apps/display-apps.tfstate.json
index eaf46fbc1e9c5..84dc3b6d12170 100644
--- a/provisioner/terraform/testdata/resources/display-apps/display-apps.tfstate.json
+++ b/provisioner/terraform/testdata/resources/display-apps/display-apps.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/external-auth-providers/external-auth-providers.tfplan.json b/provisioner/terraform/testdata/resources/external-auth-providers/external-auth-providers.tfplan.json
index 3ba31efd64be6..18ccfa17a86fc 100644
--- a/provisioner/terraform/testdata/resources/external-auth-providers/external-auth-providers.tfplan.json
+++ b/provisioner/terraform/testdata/resources/external-auth-providers/external-auth-providers.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -62,6 +63,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/external-auth-providers/external-auth-providers.tfstate.json b/provisioner/terraform/testdata/resources/external-auth-providers/external-auth-providers.tfstate.json
index 95d61e1c9dd13..afe4bd90fb722 100644
--- a/provisioner/terraform/testdata/resources/external-auth-providers/external-auth-providers.tfstate.json
+++ b/provisioner/terraform/testdata/resources/external-auth-providers/external-auth-providers.tfstate.json
@@ -40,6 +40,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/instance-id/instance-id.tfplan.json b/provisioner/terraform/testdata/resources/instance-id/instance-id.tfplan.json
index be2b976ca73da..fc0460ec584bd 100644
--- a/provisioner/terraform/testdata/resources/instance-id/instance-id.tfplan.json
+++ b/provisioner/terraform/testdata/resources/instance-id/instance-id.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "google-instance-identity",
             "connection_timeout": 120,
@@ -74,6 +75,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "google-instance-identity",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/instance-id/instance-id.tfstate.json b/provisioner/terraform/testdata/resources/instance-id/instance-id.tfstate.json
index 710eb6ff542da..cdcb9ebdab073 100644
--- a/provisioner/terraform/testdata/resources/instance-id/instance-id.tfstate.json
+++ b/provisioner/terraform/testdata/resources/instance-id/instance-id.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "google-instance-identity",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/mapped-apps/mapped-apps.tfplan.json b/provisioner/terraform/testdata/resources/mapped-apps/mapped-apps.tfplan.json
index 1eb9888c034d4..7a16a0c8bbe27 100644
--- a/provisioner/terraform/testdata/resources/mapped-apps/mapped-apps.tfplan.json
+++ b/provisioner/terraform/testdata/resources/mapped-apps/mapped-apps.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -46,6 +47,7 @@
             "command": null,
             "display_name": "app1",
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -72,6 +74,7 @@
             "command": null,
             "display_name": "app2",
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -114,6 +117,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -162,6 +166,7 @@
           "command": null,
           "display_name": "app1",
           "external": false,
+          "group": null,
           "healthcheck": [],
           "hidden": false,
           "icon": null,
@@ -199,6 +204,7 @@
           "command": null,
           "display_name": "app2",
           "external": false,
+          "group": null,
           "healthcheck": [],
           "hidden": false,
           "icon": null,
diff --git a/provisioner/terraform/testdata/resources/mapped-apps/mapped-apps.tfstate.json b/provisioner/terraform/testdata/resources/mapped-apps/mapped-apps.tfstate.json
index 67609142a56fb..c45b654349761 100644
--- a/provisioner/terraform/testdata/resources/mapped-apps/mapped-apps.tfstate.json
+++ b/provisioner/terraform/testdata/resources/mapped-apps/mapped-apps.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -61,6 +62,7 @@
             "command": null,
             "display_name": "app1",
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -92,6 +94,7 @@
             "command": null,
             "display_name": "app2",
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfplan.json b/provisioner/terraform/testdata/resources/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfplan.json
index db9a8ef88e7de..c6930602ed083 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfplan.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -42,6 +43,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -75,6 +77,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -100,6 +103,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [
               {
                 "interval": 5,
@@ -133,6 +137,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -187,6 +192,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -231,6 +237,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -278,6 +285,7 @@
           "command": null,
           "display_name": null,
           "external": false,
+          "group": null,
           "healthcheck": [],
           "hidden": false,
           "icon": null,
@@ -314,6 +322,7 @@
           "command": null,
           "display_name": null,
           "external": false,
+          "group": null,
           "healthcheck": [
             {
               "interval": 5,
@@ -360,6 +369,7 @@
           "command": null,
           "display_name": null,
           "external": false,
+          "group": null,
           "healthcheck": [],
           "hidden": false,
           "icon": null,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfstate.json b/provisioner/terraform/testdata/resources/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfstate.json
index e6b495afd49bd..12a3dab046532 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfstate.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -56,6 +57,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -104,6 +106,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -134,6 +137,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [
               {
                 "interval": 5,
@@ -172,6 +176,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfplan.json b/provisioner/terraform/testdata/resources/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfplan.json
index 199d4de0124aa..0e9ef6a899e87 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfplan.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -42,6 +43,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -143,6 +145,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -187,6 +190,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfstate.json b/provisioner/terraform/testdata/resources/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfstate.json
index 98c4b91e3fd49..4214aa1fcefb0 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfstate.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -56,6 +57,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfplan.json b/provisioner/terraform/testdata/resources/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfplan.json
index ce4c0a37c8c1e..ae850f57d1369 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfplan.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -59,6 +60,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -123,6 +125,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -148,6 +151,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [
               {
                 "interval": 5,
@@ -198,6 +202,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -266,6 +271,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -354,6 +360,7 @@
           "command": null,
           "display_name": null,
           "external": false,
+          "group": null,
           "healthcheck": [],
           "hidden": false,
           "icon": null,
@@ -390,6 +397,7 @@
           "command": null,
           "display_name": null,
           "external": false,
+          "group": null,
           "healthcheck": [
             {
               "interval": 5,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfstate.json b/provisioner/terraform/testdata/resources/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfstate.json
index 6b50ab979f487..9e1f2abeb155b 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfstate.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -73,6 +74,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -152,6 +154,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -182,6 +185,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [
               {
                 "interval": 5,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfplan.json b/provisioner/terraform/testdata/resources/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfplan.json
index 1c0141a88c14c..de7d19e8ffd8c 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfplan.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -42,6 +43,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -164,6 +166,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -208,6 +211,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfstate.json b/provisioner/terraform/testdata/resources/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfstate.json
index 8a885bb5a0735..2a1eda9aee714 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfstate.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -56,6 +57,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents/multiple-agents.tfplan.json b/provisioner/terraform/testdata/resources/multiple-agents/multiple-agents.tfplan.json
index 309442fcc4be2..90a71f1812f47 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents/multiple-agents.tfplan.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents/multiple-agents.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -42,6 +43,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 1,
@@ -72,6 +74,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "arm64",
             "auth": "token",
             "connection_timeout": 120,
@@ -102,6 +105,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -152,6 +156,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -196,6 +201,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 1,
@@ -240,6 +246,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "arm64",
           "auth": "token",
           "connection_timeout": 120,
@@ -284,6 +291,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/multiple-agents/multiple-agents.tfstate.json b/provisioner/terraform/testdata/resources/multiple-agents/multiple-agents.tfstate.json
index a6a098a53ec37..95be0a4c6f3f0 100644
--- a/provisioner/terraform/testdata/resources/multiple-agents/multiple-agents.tfstate.json
+++ b/provisioner/terraform/testdata/resources/multiple-agents/multiple-agents.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -56,6 +57,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 1,
@@ -100,6 +102,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "arm64",
             "auth": "token",
             "connection_timeout": 120,
@@ -144,6 +147,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/multiple-apps/multiple-apps.tfplan.json b/provisioner/terraform/testdata/resources/multiple-apps/multiple-apps.tfplan.json
index 171999b1226ba..f6b271c6eafb0 100644
--- a/provisioner/terraform/testdata/resources/multiple-apps/multiple-apps.tfplan.json
+++ b/provisioner/terraform/testdata/resources/multiple-apps/multiple-apps.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -45,6 +46,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -70,6 +72,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [
               {
                 "interval": 5,
@@ -103,6 +106,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -145,6 +149,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
@@ -192,6 +197,7 @@
           "command": null,
           "display_name": null,
           "external": false,
+          "group": null,
           "healthcheck": [],
           "hidden": false,
           "icon": null,
@@ -228,6 +234,7 @@
           "command": null,
           "display_name": null,
           "external": false,
+          "group": null,
           "healthcheck": [
             {
               "interval": 5,
@@ -274,6 +281,7 @@
           "command": null,
           "display_name": null,
           "external": false,
+          "group": null,
           "healthcheck": [],
           "hidden": false,
           "icon": null,
diff --git a/provisioner/terraform/testdata/resources/multiple-apps/multiple-apps.tfstate.json b/provisioner/terraform/testdata/resources/multiple-apps/multiple-apps.tfstate.json
index 1240248b6669e..3f1473f6bdcb5 100644
--- a/provisioner/terraform/testdata/resources/multiple-apps/multiple-apps.tfstate.json
+++ b/provisioner/terraform/testdata/resources/multiple-apps/multiple-apps.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -60,6 +61,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
@@ -90,6 +92,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [
               {
                 "interval": 5,
@@ -128,6 +131,7 @@
             "command": null,
             "display_name": null,
             "external": false,
+            "group": null,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
diff --git a/provisioner/terraform/testdata/resources/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json b/provisioner/terraform/testdata/resources/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json
index b8fcf0625741b..ae38a9f3571d2 100644
--- a/provisioner/terraform/testdata/resources/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json
+++ b/provisioner/terraform/testdata/resources/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -129,6 +130,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json b/provisioner/terraform/testdata/resources/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json
index 96a1bb0410222..01ce6c6e468f1 100644
--- a/provisioner/terraform/testdata/resources/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json
+++ b/provisioner/terraform/testdata/resources/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/resource-metadata/resource-metadata.tfplan.json b/provisioner/terraform/testdata/resources/resource-metadata/resource-metadata.tfplan.json
index ff44c490a39bf..fa655c82da94e 100644
--- a/provisioner/terraform/testdata/resources/resource-metadata/resource-metadata.tfplan.json
+++ b/provisioner/terraform/testdata/resources/resource-metadata/resource-metadata.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
@@ -116,6 +117,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "amd64",
           "auth": "token",
           "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/resource-metadata/resource-metadata.tfstate.json b/provisioner/terraform/testdata/resources/resource-metadata/resource-metadata.tfstate.json
index a690f36133fd1..aa0a8e91c5a22 100644
--- a/provisioner/terraform/testdata/resources/resource-metadata/resource-metadata.tfstate.json
+++ b/provisioner/terraform/testdata/resources/resource-metadata/resource-metadata.tfstate.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "amd64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/rich-parameters-order/rich-parameters-order.tfplan.json b/provisioner/terraform/testdata/resources/rich-parameters-order/rich-parameters-order.tfplan.json
index 4c6e99ed4bba5..55226481d34b5 100644
--- a/provisioner/terraform/testdata/resources/rich-parameters-order/rich-parameters-order.tfplan.json
+++ b/provisioner/terraform/testdata/resources/rich-parameters-order/rich-parameters-order.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "arm64",
             "auth": "token",
             "connection_timeout": 120,
@@ -62,6 +63,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "arm64",
           "auth": "token",
           "connection_timeout": 120,
@@ -134,6 +136,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "c3a48d5e-50ba-4364-b05f-e73aaac9386a",
               "mutable": false,
@@ -141,6 +144,7 @@
               "option": null,
               "optional": false,
               "order": 55,
+              "styling": "{}",
               "type": "string",
               "validation": [],
               "value": ""
@@ -161,6 +165,7 @@
               "description": "blah blah",
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "61707326-5652-49ac-9e8d-86ac01262de7",
               "mutable": false,
@@ -168,6 +173,7 @@
               "option": null,
               "optional": true,
               "order": 99,
+              "styling": "{}",
               "type": "string",
               "validation": [],
               "value": "ok"
diff --git a/provisioner/terraform/testdata/resources/rich-parameters-order/rich-parameters-order.tfstate.json b/provisioner/terraform/testdata/resources/rich-parameters-order/rich-parameters-order.tfstate.json
index f54a97b9b0f76..58b0950e84d73 100644
--- a/provisioner/terraform/testdata/resources/rich-parameters-order/rich-parameters-order.tfstate.json
+++ b/provisioner/terraform/testdata/resources/rich-parameters-order/rich-parameters-order.tfstate.json
@@ -16,6 +16,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "1f22af56-31b6-40d1-acc9-652a5e5c8a8d",
             "mutable": false,
@@ -23,6 +24,7 @@
             "option": null,
             "optional": false,
             "order": 55,
+            "styling": "{}",
             "type": "string",
             "validation": [],
             "value": ""
@@ -43,6 +45,7 @@
             "description": "blah blah",
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "bc6ed4d8-ea44-4afc-8641-7b0bf176145d",
             "mutable": false,
@@ -50,6 +53,7 @@
             "option": null,
             "optional": true,
             "order": 99,
+            "styling": "{}",
             "type": "string",
             "validation": [],
             "value": "ok"
@@ -66,6 +70,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "arm64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/rich-parameters-validation/rich-parameters-validation.tfplan.json b/provisioner/terraform/testdata/resources/rich-parameters-validation/rich-parameters-validation.tfplan.json
index 28e0219b4568a..54e4e33c826c3 100644
--- a/provisioner/terraform/testdata/resources/rich-parameters-validation/rich-parameters-validation.tfplan.json
+++ b/provisioner/terraform/testdata/resources/rich-parameters-validation/rich-parameters-validation.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "arm64",
             "auth": "token",
             "connection_timeout": 120,
@@ -62,6 +63,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "arm64",
           "auth": "token",
           "connection_timeout": 120,
@@ -134,6 +136,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": true,
+              "form_type": "input",
               "icon": null,
               "id": "44d79e2a-4bbf-42a7-8959-0bc07e37126b",
               "mutable": true,
@@ -141,6 +144,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [],
               "value": "4"
@@ -161,6 +165,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "ae80adac-870e-4b35-b4e4-57abf91a1fe2",
               "mutable": false,
@@ -168,6 +173,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [
                 {
@@ -200,6 +206,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "6a52ec1e-b8b8-4445-a255-2020cc93a952",
               "mutable": false,
@@ -207,6 +214,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [
                 {
@@ -239,6 +247,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "9c799b8e-7cc1-435b-9789-71d8c4cd45dc",
               "mutable": false,
@@ -246,6 +255,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [
                 {
@@ -278,6 +288,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "a1da93d3-10a9-4a55-a4db-fba2fbc271d3",
               "mutable": false,
@@ -285,6 +296,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [
                 {
@@ -317,6 +329,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "f6555b94-c121-49df-b577-f06e8b5b9adc",
               "mutable": false,
@@ -324,6 +337,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [
                 {
diff --git a/provisioner/terraform/testdata/resources/rich-parameters-validation/rich-parameters-validation.tfstate.json b/provisioner/terraform/testdata/resources/rich-parameters-validation/rich-parameters-validation.tfstate.json
index 592c62fcfd6e2..2c718e2b48b21 100644
--- a/provisioner/terraform/testdata/resources/rich-parameters-validation/rich-parameters-validation.tfstate.json
+++ b/provisioner/terraform/testdata/resources/rich-parameters-validation/rich-parameters-validation.tfstate.json
@@ -16,6 +16,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": true,
+            "form_type": "input",
             "icon": null,
             "id": "69d94f37-bd4f-4e1f-9f35-b2f70677be2f",
             "mutable": true,
@@ -23,6 +24,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [],
             "value": "4"
@@ -43,6 +45,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "5184898a-1542-4cc9-95ee-6c8f10047836",
             "mutable": false,
@@ -50,6 +53,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [
               {
@@ -82,6 +86,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "23c02245-5e89-42dd-a45f-8470d9c9024a",
             "mutable": false,
@@ -89,6 +94,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [
               {
@@ -121,6 +127,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "9f61eec0-ec39-4649-a972-6eaf9055efcc",
             "mutable": false,
@@ -128,6 +135,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [
               {
@@ -160,6 +168,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "3fd9601e-4ddb-4b56-af9f-e2391f9121d2",
             "mutable": false,
@@ -167,6 +176,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [
               {
@@ -199,6 +209,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "fe0b007a-b200-4982-ba64-d201bdad3fa0",
             "mutable": false,
@@ -206,6 +217,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [
               {
@@ -234,6 +246,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "arm64",
             "auth": "token",
             "connection_timeout": 120,
diff --git a/provisioner/terraform/testdata/resources/rich-parameters/rich-parameters.tfplan.json b/provisioner/terraform/testdata/resources/rich-parameters/rich-parameters.tfplan.json
index 677af8a4d5cb4..66151089fb40a 100644
--- a/provisioner/terraform/testdata/resources/rich-parameters/rich-parameters.tfplan.json
+++ b/provisioner/terraform/testdata/resources/rich-parameters/rich-parameters.tfplan.json
@@ -12,6 +12,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "arm64",
             "auth": "token",
             "connection_timeout": 120,
@@ -62,6 +63,7 @@
         ],
         "before": null,
         "after": {
+          "api_key_scope": "all",
           "arch": "arm64",
           "auth": "token",
           "connection_timeout": 120,
@@ -134,6 +136,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "radio",
               "icon": null,
               "id": "8bdcc469-97c7-4efc-88a6-7ab7ecfefad5",
               "mutable": false,
@@ -154,6 +157,7 @@
               ],
               "optional": false,
               "order": null,
+              "styling": "{}",
               "type": "string",
               "validation": [],
               "value": ""
@@ -178,6 +182,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "ba77a692-d2c2-40eb-85ce-9c797235da62",
               "mutable": false,
@@ -185,6 +190,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [],
               "value": "4"
@@ -205,6 +211,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "89e0468f-9958-4032-a8b9-b25236158608",
               "mutable": false,
@@ -212,6 +219,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [
                 {
@@ -244,6 +252,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "dac2ff5a-a18b-4495-97b6-80981a54e006",
               "mutable": false,
@@ -251,6 +260,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [
                 {
@@ -283,6 +293,7 @@
               "description": null,
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "963de99d-dcc0-4ab9-923f-8a0f061333dc",
               "mutable": false,
@@ -290,6 +301,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "number",
               "validation": [
                 {
@@ -322,6 +334,7 @@
               "description": "blah blah",
               "display_name": null,
               "ephemeral": false,
+              "form_type": "input",
               "icon": null,
               "id": "9c99eaa2-360f-4bf7-969b-5e270ff8c75d",
               "mutable": false,
@@ -329,6 +342,7 @@
               "option": null,
               "optional": true,
               "order": null,
+              "styling": "{}",
               "type": "string",
               "validation": [],
               "value": "ok"
@@ -353,6 +367,7 @@
                   "description": "First parameter from module",
                   "display_name": null,
                   "ephemeral": false,
+                  "form_type": "input",
                   "icon": null,
                   "id": "baa03cd7-17f5-4422-8280-162d963a48bc",
                   "mutable": true,
@@ -360,6 +375,7 @@
                   "option": null,
                   "optional": true,
                   "order": null,
+                  "styling": "{}",
                   "type": "string",
                   "validation": [],
                   "value": "abcdef"
@@ -380,6 +396,7 @@
                   "description": "Second parameter from module",
                   "display_name": null,
                   "ephemeral": false,
+                  "form_type": "input",
                   "icon": null,
                   "id": "4c0ed40f-0047-4da0-b0a1-9af7b67524b4",
                   "mutable": true,
@@ -387,6 +404,7 @@
                   "option": null,
                   "optional": true,
                   "order": null,
+                  "styling": "{}",
                   "type": "string",
                   "validation": [],
                   "value": "ghijkl"
@@ -412,6 +430,7 @@
                       "description": "First parameter from child module",
                       "display_name": null,
                       "ephemeral": false,
+                      "form_type": "input",
                       "icon": null,
                       "id": "f48b69fc-317e-426e-8195-dfbed685b3f5",
                       "mutable": true,
@@ -419,6 +438,7 @@
                       "option": null,
                       "optional": true,
                       "order": null,
+                      "styling": "{}",
                       "type": "string",
                       "validation": [],
                       "value": "abcdef"
@@ -439,6 +459,7 @@
                       "description": "Second parameter from child module",
                       "display_name": null,
                       "ephemeral": false,
+                      "form_type": "input",
                       "icon": null,
                       "id": "c6d10437-e74d-4a34-8da7-5125234d7dd4",
                       "mutable": true,
@@ -446,6 +467,7 @@
                       "option": null,
                       "optional": true,
                       "order": null,
+                      "styling": "{}",
                       "type": "string",
                       "validation": [],
                       "value": "ghijkl"
diff --git a/provisioner/terraform/testdata/resources/rich-parameters/rich-parameters.tfstate.json b/provisioner/terraform/testdata/resources/rich-parameters/rich-parameters.tfstate.json
index c84310be0e773..3c1725721d774 100644
--- a/provisioner/terraform/testdata/resources/rich-parameters/rich-parameters.tfstate.json
+++ b/provisioner/terraform/testdata/resources/rich-parameters/rich-parameters.tfstate.json
@@ -16,6 +16,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "radio",
             "icon": null,
             "id": "39cdd556-8e21-47c7-8077-f9734732ff6c",
             "mutable": false,
@@ -36,6 +37,7 @@
             ],
             "optional": false,
             "order": null,
+            "styling": "{}",
             "type": "string",
             "validation": [],
             "value": ""
@@ -60,6 +62,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "3812e978-97f0-460d-a1ae-af2a49e339fb",
             "mutable": false,
@@ -67,6 +70,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [],
             "value": "4"
@@ -87,6 +91,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "83ba35bf-ca92-45bc-9010-29b289e7b303",
             "mutable": false,
@@ -94,6 +99,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [
               {
@@ -126,6 +132,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "3a8d8ea8-4459-4435-bf3a-da5e00354952",
             "mutable": false,
@@ -133,6 +140,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [
               {
@@ -165,6 +173,7 @@
             "description": null,
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "3c641e1c-ba27-4b0d-b6f6-d62244fee536",
             "mutable": false,
@@ -172,6 +181,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "number",
             "validation": [
               {
@@ -204,6 +214,7 @@
             "description": "blah blah",
             "display_name": null,
             "ephemeral": false,
+            "form_type": "input",
             "icon": null,
             "id": "f00ed554-9be3-4b40-8787-2c85f486dc17",
             "mutable": false,
@@ -211,6 +222,7 @@
             "option": null,
             "optional": true,
             "order": null,
+            "styling": "{}",
             "type": "string",
             "validation": [],
             "value": "ok"
@@ -227,6 +239,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "api_key_scope": "all",
             "arch": "arm64",
             "auth": "token",
             "connection_timeout": 120,
@@ -295,6 +308,7 @@
                 "description": "First parameter from module",
                 "display_name": null,
                 "ephemeral": false,
+                "form_type": "input",
                 "icon": null,
                 "id": "74f60a35-c5da-4898-ba1b-97e9726a3dd7",
                 "mutable": true,
@@ -302,6 +316,7 @@
                 "option": null,
                 "optional": true,
                 "order": null,
+                "styling": "{}",
                 "type": "string",
                 "validation": [],
                 "value": "abcdef"
@@ -322,6 +337,7 @@
                 "description": "Second parameter from module",
                 "display_name": null,
                 "ephemeral": false,
+                "form_type": "input",
                 "icon": null,
                 "id": "af4d2ac0-15e2-4648-8219-43e133bb52af",
                 "mutable": true,
@@ -329,6 +345,7 @@
                 "option": null,
                 "optional": true,
                 "order": null,
+                "styling": "{}",
                 "type": "string",
                 "validation": [],
                 "value": "ghijkl"
@@ -354,6 +371,7 @@
                     "description": "First parameter from child module",
                     "display_name": null,
                     "ephemeral": false,
+                    "form_type": "input",
                     "icon": null,
                     "id": "c7ffff35-e3d5-48fe-9714-3fb160bbb3d1",
                     "mutable": true,
@@ -361,6 +379,7 @@
                     "option": null,
                     "optional": true,
                     "order": null,
+                    "styling": "{}",
                     "type": "string",
                     "validation": [],
                     "value": "abcdef"
@@ -381,6 +400,7 @@
                     "description": "Second parameter from child module",
                     "display_name": null,
                     "ephemeral": false,
+                    "form_type": "input",
                     "icon": null,
                     "id": "45b6bdbe-1233-46ad-baf9-4cd7e73ce3b8",
                     "mutable": true,
@@ -388,6 +408,7 @@
                     "option": null,
                     "optional": true,
                     "order": null,
+                    "styling": "{}",
                     "type": "string",
                     "validation": [],
                     "value": "ghijkl"