Skip to main content
Prerequisites:
Daytona secret names must start with a letter or an underscore, and can contain only letters, digits, hyphens, and underscores. A sync that includes a key Daytona rejects fails and names the offending key, so no secrets are written.

​
Allowed hosts stay under your control in Daytona

Daytona never places a secret’s value in a sandbox. It sets the environment variable to an opaque placeholder and substitutes the real value in its egress proxy, but only for requests to hosts on that secret’s allowed hosts list. A secret with no allowed hosts is unrestricted: Daytona substitutes the value for a request to any host. Infisical never sets or changes allowed hosts. Creating a secret sends its name and value, and updating one sends only the value, so the allowed hosts you set in Daytona are preserved by every later sync. Nothing you configure here can widen or narrow them. Set allowed hosts on a secret in Daytona after the first sync creates it. The list is per secret, so each one can be restricted to the destinations it’s actually used with, and it survives from then on.
1

Add sync

Navigate to Project > Integrations and select the Secret Syncs tab. Select the Add Sync button.
2

Select 'Daytona'

Select the Daytona option from the list of available secret syncs.
3

Configure source

Configure the Source from where secrets should be retrieved, then select Continue.
  • Environment: The project environment to retrieve secrets from.
  • Secret Path: The folder path to retrieve secrets from.
If you need to sync secrets from multiple folder locations, check out secret imports.
4

Configure destination

Select the Daytona Connection to authenticate with, then select Continue. The connection’s API key determines which Daytona organization receives the secrets, so there is nothing further to configure.
5

Choose initial sync behavior

Choose how Infisical reconciles the secrets already in Daytona on the first run, then select Continue.Daytona never returns a secret’s value through its API, so this sync cannot import existing secrets into Infisical. Overwrite Daytona is the only behavior available.
6

Configure sync options

Configure the Sync Options to specify how secrets should be synced, then select Continue.
  • Disable secret deletion: When enabled, Infisical does not remove secrets from the Daytona organization. Enable this if you intend to manage some secrets manually outside of Infisical.
  • Auto-sync on changes: When enabled, secrets sync to Daytona automatically as the source changes. Turn it off to sync manually only.
  • Customize key names: Adds a prefix or suffix to every synced name, using {{secretKey}} as a placeholder for the original name and {{environment}} for the environment.
We highly recommend customizing key names so Infisical only manages the specific keys you intend, keeping everything else untouched.
7

Configure details

Give the sync a Name and an optional Description, then select Continue. The name must be slug-friendly.
8

Review and create

Review your Daytona sync configuration, then select Create Sync.
9

Sync created

If auto-sync is enabled, your Daytona sync begins syncing your secrets to the destination organization.