diff --git a/env0/data_sshkey_test.go b/env0/data_sshkey_test.go
new file mode 100644
index 00000000..81104388
--- /dev/null
+++ b/env0/data_sshkey_test.go
@@ -0,0 +1,50 @@
+package env0
+
+import (
+	"encoding/json"
+	"github.com/env0/terraform-provider-env0/client"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"testing"
+)
+
+func TestUnitSshKeyDataSourceById(t *testing.T) {
+	testUnitSshKeyDataSource(t, "id")
+}
+
+func TestUnitSshKeyDataSourceByName(t *testing.T) {
+	testUnitSshKeyDataSource(t, "name")
+}
+
+func testUnitSshKeyDataSource(t *testing.T, byKey string) {
+	resourceType := "env0_ssh_key"
+	resourceName := "test"
+	resourceFullName := dataSourceAccessor(resourceType, resourceName)
+	sshKey := client.SshKey{
+		Id:    "id0",
+		Name:  "name0",
+		Value: "Key🔑",
+	}
+
+	sshKeyAsJson, _ := json.Marshal(sshKey)
+	var jsonData map[string]string
+	_ = json.Unmarshal(sshKeyAsJson, &jsonData)
+
+	testCase := resource.TestCase{
+		Steps: []resource.TestStep{
+			{
+				Config: dataSourceConfigCreate(resourceType, resourceName, map[string]string{
+					byKey: jsonData[byKey],
+				}),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceFullName, "id", sshKey.Id),
+					resource.TestCheckResourceAttr(resourceFullName, "name", sshKey.Name),
+				),
+			},
+		},
+	}
+
+	runUnitTest(t, testCase, func(mock *client.MockApiClientInterface) {
+		// TODO: AnyTimes because we find that READ runs for 5 times. need investigation.
+		mock.EXPECT().SshKeys().AnyTimes().Return([]client.SshKey{sshKey}, nil)
+	})
+}
diff --git a/env0/resource_sshkey.go b/env0/resource_sshkey.go
index 1f6ab77a..fb6ad688 100644
--- a/env0/resource_sshkey.go
+++ b/env0/resource_sshkey.go
@@ -30,6 +30,7 @@ func resourceSshKey() *schema.Resource {
 				Description: "value is a private key in PEM format (first line usually looks like -----BEGIN OPENSSH PRIVATE KEY-----)",
 				Required:    true,
 				ForceNew:    true,
+				Sensitive:   true,
 			},
 		},
 	}
diff --git a/env0/resource_sshkey_test.go b/env0/resource_sshkey_test.go
new file mode 100644
index 00000000..79efa52f
--- /dev/null
+++ b/env0/resource_sshkey_test.go
@@ -0,0 +1,40 @@
+package env0
+
+import (
+	"github.com/env0/terraform-provider-env0/client"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"testing"
+)
+
+func TestUnitSshKeyResource(t *testing.T) {
+	resourceType := "env0_ssh_key"
+	resourceName := "test"
+	resourceFullName := resourceAccessor(resourceType, resourceName)
+	sshKey := client.SshKey{
+		Id:    "id0",
+		Name:  "name0",
+		Value: "Key🔑",
+	}
+
+	testCase := resource.TestCase{
+		Steps: []resource.TestStep{
+			{
+				Config: resourceConfigCreate(resourceType, resourceName, map[string]string{
+					"name":  sshKey.Name,
+					"value": sshKey.Value,
+				}),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceFullName, "id", sshKey.Id),
+					resource.TestCheckResourceAttr(resourceFullName, "name", sshKey.Name),
+					resource.TestCheckResourceAttr(resourceFullName, "value", sshKey.Value),
+				),
+			},
+		},
+	}
+
+	runUnitTest(t, testCase, func(mock *client.MockApiClientInterface) {
+		mock.EXPECT().SshKeyCreate(client.SshKeyCreatePayload{Name: sshKey.Name, Value: sshKey.Value}).Times(1).Return(sshKey, nil)
+		mock.EXPECT().SshKeys().Times(1).Return([]client.SshKey{sshKey}, nil)
+		mock.EXPECT().SshKeyDelete(sshKey.Id).Times(1).Return(nil)
+	})
+}
diff --git a/env0/test_helpers.go b/env0/test_helpers.go
index 4ea8c01a..44d40e33 100644
--- a/env0/test_helpers.go
+++ b/env0/test_helpers.go
@@ -38,7 +38,7 @@ func resourceConfigCreate(resourceType string, resourceName string, fields map[s
 func hclConfigCreate(source TFSource, resourceType string, resourceName string, fields map[string]string) string {
 	hclFields := ""
 	for key, value := range fields {
-		hclFields += fmt.Sprintf("\n\t\"%s\" = \"%s\"", key, value)
+		hclFields += fmt.Sprintf("\n\t%s = \"%s\"", key, value)
 	}
 	if hclFields != "" {
 		hclFields += "\n"