Skip to main content
This quickstart creates a machine identity with Universal Auth credentials and uses those credentials to make an authenticated request to the Infisical API.
This quickstart uses Universal Auth. For the full list of authentication methods and when to pick each one, see Authentication.

​
Prerequisites

  • The Admin role on either your Infisical organization or a project in the organization

​
Step 1: Create a machine identity

You can create a machine identity at the organization level or scoped to a single project. The rest of the quickstart works the same either way.
1
In your organization, go to Access Control > Machine Identities, then select Create.
2
Enter a Name for the identity, pick an organization Role (Admin or Member are both fine for this guide), and select Create.
This creates the identity with Universal Auth enabled by default and opens the identity’s details page.

​
Step 2: Generate a client secret

Universal Auth uses a Client ID and Client Secret pair. Infisical creates the Client ID with the identity but issues each Client Secret on demand.
1
On the identity’s details page, in the Authentication card, select the Universal Auth row.
2
In the sheet that opens, copy the Client ID.
3
Select Add Client Secret, then Create to generate a new secret.
Infisical shows the Client Secret only once. Copy it now and store it somewhere safe before closing the dialog.

​
Step 3: Exchange the credentials for an access token

Call the login endpoint for Universal Auth with the Client ID and Client Secret in the request body:
The response contains the access token, the token’s remaining lifetime in seconds (expiresIn), and the maximum lifetime the token can reach with renewals (accessTokenMaxTTL):

​
Step 4: Call the API with the access token

Include the access token as an Authorization: Bearer header on every request. For example, to look up the identity’s own details:
The response returns the organization the identity belongs to:
Every endpoint in this reference accepts the same Authorization header format.
You can now make authenticated calls to the Infisical API.

​
Next steps

To call an endpoint that operates on a project’s resources (for example, reading secrets, issuing certificates, or managing PAM resources), the identity needs to be a member of that project. If you create the machine identity at the organization-level, it needs to be added to each project you want it to reach. You can do this from Access Control > Machine Identities inside the project itself. For more information, check out the machine identity docs:

Machine identities

How machine identities work, including scopes, project membership, roles, credential rotation, and alerts.