`).
* **Application Keys**: a Datadog [API Key](https://docs.datadoghq.com/account_management/api-app-keys/) paired with a Service Account [Application Key](https://docs.datadoghq.com/account_management/org_settings/service_accounts/).
We recommend the **Service Access Token** method. Tokens are scoped, can be given an expiration, and are bound to a dedicated Service Account, so the credentials Infisical uses can be rotated and revoked independently of any individual user. The **Application Keys** method remains available for existing setups.
## Create Datadog Credentials
From your Datadog dashboard, hover the bottom left where it says **Integrations**. This will open a window with **Organization Settings**
![Open Organization Settings]()
In **Organization Settings**, open the **Service Accounts** section from the left sidebar.
![Service Accounts Option]()
On the **Service Accounts** page, click **New Service Account**.
![Service Accounts Page]()
Provide a name, email, and select a role for the Service Account, then click **Create Service Account**.
The Service Account's role determines which resources Infisical can access. Make sure it has access to the resources you want Infisical to manage. For secret rotation, it is required to have the `Datadog Admin Role` as a base so the token can be scoped.
![Create Service Account]()
Once created, click the Service Account in the list to open its details, where you can manage its **Access Tokens**.
![Service Account Created]()
In the Service Account's details panel, find the **Access Tokens** section and click **+ New Token**.
![Create Access Token]()
Enter a descriptive **Name** for the token (e.g. `infisical-connection`) and choose an **Expiration Date** (`1 day`, `1 month`, `1 year`, `Never`, or `Custom`).
![Access Token Name]()
Click **Select Scopes** to define what the token can access. Grant only the permissions your workflow requires, then click **Save**.
For [Datadog Application Key Secret Rotation](/docs/documentation/platform/secret-rotation/datadog-application-key-secret), the token needs scopes to read users and manage Service Account Application Keys. Set `user_app_keys` under **API and Application Keys** and `service_account_write`, `user_access_manage`, and `user_access_read` under **Access Management**.
![Application Key button]()
For [Datadog API Key Secret Rotation](/docs/documentation/platform/secret-rotation/datadog-api-key), the token needs scopes to delete and read API Keys. Set `api_keys_delete` and `api_keys_write` under **API and Application Keys**.
![API key rotation]()
Datadog displays the token secret **only once** at creation time. Copy the **token value** and store it somewhere safe. You will need it when creating the Infisical connection.
![Copy Access Token]()
From your Datadog dashboard, hover the bottom left where it says **Integrations**. This will open a window with **Organization Settings**
![Open Organization Settings]()
In the left sidebar, select **API Keys**.
![API Keys Option]()
Click the **New Key** button in the top-right corner.
![New API Key Button]()
Provide a descriptive name for the API Key (e.g. `infisical-connection`) and click **Create Key**.
![Name API Key]()
Copy the generated **API Key** value and store it somewhere safe. You will need it when creating the Infisical connection.
![Copy API Key]()
Back in **Organization Settings**, open the **Service Accounts** section from the left sidebar.
![Service Accounts Option]()
On the **Service Accounts** page, click **New Service Account**.
![Service Accounts Page]()
Provide a name, email, and select a role for the Service Account, then click **Create Service Account**.
The Service Account's role determines which resources Infisical can access. Make sure it has access to the resources you want Infisical to manage. For secret rotation, it is required to have the `Datadog Admin Role` as a base so the **Application Key can be scoped**
![Create Service Account]()
Once created, click on created the Service Account from the list to manage its Application Keys.
![Service Account Created]()
Under the **Application Keys** section of the Service Account, click **New Key**.
![Create Application Key]()
Define a name for the application key
![Application Key Name]()
Assign the scopes required for your use case. On **Scope** click on **Edit**, so you can define the scopes you want. If this is left empty, the scope of this key will be the same as the service account.
For [Datadog Application Key Secret Rotation](/docs/documentation/platform/secret-rotation/datadog-application-key-secret), the token needs scopes to read users and manage Service Account Application Keys. Set `user_app_keys` under **API and Application Keys** and `service_account_write`, `user_access_manage`, and `user_access_read` under **Access Management**.
![Application Key button]()
For [Datadog API Key Secret Rotation](/docs/documentation/platform/secret-rotation/datadog-api-key), the token needs scopes to delete and read API Keys. Set `api_keys_delete` and `api_keys_write` under **API and Application Keys**.
![API key rotation]()
Copy the **Application Key** value and store it somewhere safe. You will need it when creating the Infisical connection.
![Application Key Scopes]()
## Create Datadog Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the \*\* Add Connection\*\* button and select **Datadog** from the list of available connections.
![Datadog Connection form]()
Complete the Datadog Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The **Method** you want to use to authenticate (**Service Access Token**, recommended, or **Application Keys**)
* The Datadog **URL** for your region (e.g. `https://api.datadoghq.com`, `https://api.us5.datadoghq.com`, or `https://api.ddog-gov.com`)
* If using **Service Access Token**: the Datadog **Service Access Token**
* If using **Application Keys**: the **API Key** and the Service Account **Application Key** from the earlier steps
![Datadog Connection form]()
After clicking Create, your **Datadog Connection** is established and ready to use with your Infisical project.
![Datadog Connection form]()
To create a Datadog Connection, make an API request to the [Create Datadog Connection](/docs/api-reference/endpoints/app-connections/datadog/create) API endpoint.
### Sample request
```bash Service Access Token (Recommended) theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/datadog \
--header 'Content-Type: application/json' \
--data '{
"name": "my-datadog-connection",
"method": "token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"url": "https://api.datadoghq.com",
"token": ""
}
}'
```
```bash Application Keys theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/datadog \
--header 'Content-Type: application/json' \
--data '{
"name": "my-datadog-connection",
"method": "api-key",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"url": "https://api.datadoghq.com",
"apiKey": "",
"applicationKey": ""
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-datadog-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "datadog",
"method": "api-key",
"credentials": {
"url": "https://api.datadoghq.com"
}
}
}
```
# DBT Connection
Source: https://infisical.com/docs/integrations/app-connections/dbt
Learn how to configure a DBT Connection for Infisical.
Infisical supports the use of [Personal Access Tokens](https://docs.getdbt.com/docs/dbt-cloud-apis/user-tokens) to connect with DBT.
## Create DBT Personal Access Token
On your DBT dashboard, press the organization name in the bottom left corner, and press **Account Settings**.
![DBT Account Settings]()
Click on the **Personal Access Tokens** tab and click **Create personal access token**.
![Create Personal Access Token]()
Enter a descriptive name for the token and click **Save**.
![Enter Token Name]()
Copy the token from the modal for later steps.
![Copy Token]()
## Create DBT Connection in Infisical
In your Infisical dashboard, navigate to the **App Connections** page in the desired project.
![App Connections Tab]()
Click the **Add Connection** button and select **DBT** from the list of available connections.
![Select DBT Connection]()
Complete the DBT Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* Your DBT instance URL
* Your DBT account ID
* The Personal Access Token from earlier steps
![Connection Modal]()
After clicking Create, your **DBT Connection** is established and ready to use with your Infisical project.
![Connection Created]()
To create a DBT Connection, make an API request to the [Create DBT Connection](/docs/api-reference/endpoints/app-connections/dbt/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/dbt \
--header 'Content-Type: application/json' \
--data '{
"name": "my-dbt-connection",
"method": "api-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"instanceUrl": "https://example.dbt.com",
"accountId": "",
"apiToken": ""
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-dbt-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "dbt",
"method": "api-token",
"credentials": {
"instanceUrl": "https://example.dbt.com",
"accountId": ""
}
}
}
```
# Devin Connection
Source: https://infisical.com/docs/integrations/app-connections/devin
Learn how to configure a Devin connection for Infisical.
[Devin](https://devin.ai/) is an AI software engineer from Cognition. Infisical supports connecting to Devin using a service-user **API Key**, which is used to push secrets into a Devin organization via [Devin Secret Sync](/docs/integrations/secret-syncs/devin).
## Prerequisites
* A [Devin account](https://app.devin.ai/) with an organization you can manage
## Create a Devin API Key
In your Devin organization settings, create a service user that Infisical will act as. Fill in the service user details and submit the form.
![Devin Service User]()
Devin displays the new service user's API key immediately after creation. Copy the key, it begins with the `cog_` prefix and will only be shown once. Store it securely; you will use it when creating the Infisical connection.
![Devin API Key]()
## Create Devin Connection in Infisical
In your Infisical dashboard, go to **Organization Settings** → **App Connections** (or the **Integrations** → **App Connections** tab in your project).
![App Connections Tab]()
Click **Add Connection** and choose **Devin** from the list of available connections.
![Select Devin Connection]()
Complete the form with:
* A **name** for the connection (e.g. `devin-prod`)
* An optional **description**
* Your **Devin API Key** (the `cog_…` value from the steps above)
![Devin Connection Form]()
After clicking Create, your **Devin Connection** is established and ready to use with your Infisical project.
Create a Devin connection via the API.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/devin \
--header 'Content-Type: application/json' \
--data '{
"name": "my-devin-connection",
"method": "api-key",
"credentials": {
"apiKey": "cog_"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-devin-connection",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2026-04-20T19:46:34.831Z",
"updatedAt": "2026-04-20T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"app": "devin",
"method": "api-key",
"credentials": {}
}
}
```
# DigiCert Connection
Source: https://infisical.com/docs/integrations/app-connections/digicert
Learn how to configure a DigiCert connection for Infisical.
Infisical supports connecting to [DigiCert CertCentral](https://dev.digicert.com/en/certcentral-apis.html) using a **CertCentral API Key**. This connection powers the [DigiCert Certificate Authority](/docs/documentation/platform/pki/ca/digicert-direct) for direct (non-ACME) certificate issuance.
This connection is for the DigiCert **CertCentral Services API**. If you are using DigiCert's
ACME endpoint with External Account Binding (EAB) credentials, use the
[ACME Certificate Authority](/docs/documentation/platform/pki/ca/acme-ca) instead.
## Prerequisites
* A CertCentral account with sufficient permissions to create API keys and place certificate orders
* At least one validated CertCentral organization that will be listed on issued certificates
* A CertCentral user with a role that can place and manage orders (typically **Manager** or **Administrator**) — the API key inherits its permissions from this user
## Create a CertCentral API Key
In your CertCentral account, go to **Automation** → **API Keys** and click **Add API Key**.
![CertCentral API Keys]()
Give the key a descriptive name (e.g. `infisical`) and **assign a user whose role is Manager or Administrator**, the key inherits that user's permissions on CertCentral.
Under **API key restrictions**, leave the default **None** or select **Orders, Domains, Organizations**
Copy the generated key value, it is only shown once.
![CertCentral Create Key]()
Create a dedicated API key for Infisical rather than reusing an existing one so you can rotate or
revoke access independently.
## Create DigiCert Connection in Infisical
In your Infisical dashboard, go to **Organization Settings** → **App Connections**.
![App Connections Tab]()
Click **Add Connection** and choose **DigiCert** from the list of available connections.
![Select DigiCert Connection]()
Complete the form with:
* A **name** for the connection (e.g. `digicert-prod`)
* An optional **description**
* The **CertCentral Region** matching your account, **US** or **EU**
* Your **CertCentral API Key**
![DigiCert Connection Form]()
After clicking **Create**, Infisical validates the key by calling
`GET /services/v2/organization`. Once the key is confirmed, the connection is ready to use
in a DigiCert Certificate Authority.
![DigiCert Connection Created]()
To create a DigiCert Connection, make an API request to the [Create DigiCert Connection](/docs/api-reference/endpoints/app-connections/digicert/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/digicert \
--header 'Content-Type: application/json' \
--data '{
"name": "my-digicert-connection",
"method": "api-key",
"credentials": {
"apiKey": "",
"region": "us"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-digicert-connection",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2026-04-20T00:00:00.000Z",
"updatedAt": "2026-04-20T00:00:00.000Z",
"isPlatformManagedCredentials": false,
"app": "digicert",
"method": "api-key",
"credentials": {}
}
}
```
# DigitalOcean Connection
Source: https://infisical.com/docs/integrations/app-connections/digital-ocean
Learn how to configure a DigitalOcean Connection for Infisical.
Infisical supports the use of [API Tokens](https://cloud.digitalocean.com/account/api/tokens) to connect with DigitalOcean.
## Create a DigitalOcean API Token
![DigitalOcean Dashboard]()
![API Section]()
Give your token a descriptive name and ensure custom scopes is selected.
![Token Form]()
```
read:account
read:actions
read:regions
read:sizes
read:app/projects
update:app
```
![Token Form]()
![Token Form]()
Make sure to copy the token now—you won't be able to see it again.
![Token Generated]()
## Create a DigitalOcean Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **DigitalOcean Connection** from the list of integrations.
![Select DigitalOcean Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* The API Token from the previous step
![DigitalOcean Connection Modal]()
After submitting the form, your **DigitalOcean Connection** will be successfully created and ready to use with your Infisical project.
![DigitalOcean Connection Created]()
To create a DigitalOcean Connection via API, send a request to the [Create DigitalOcean Connection](/docs/api-reference/endpoints/app-connections/digital-ocean/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/digital-ocean \
--header 'Content-Type: application/json' \
--data '{
"name": "my-digitalocean-connection",
"method": "api-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiToken": "[API TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-digitalocean-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2025-07-19T10:15:00.000Z",
"updatedAt": "2025-07-19T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "digital-ocean",
"method": "api-token",
"credentials": {}
}
}
```
# DNS Made Easy
Source: https://infisical.com/docs/integrations/app-connections/dns-made-easy
Learn how to configure a DNS Made Easy Connection for Infisical.
Infisical supports connecting to DNS Made Easy using API key and secret key for secure access to your DNS Made Easy service.
## Configure API key and secret Key for Infisical
Navigate to your DNS Made Easy dashboard and go to **Account Information** under the **Config** top menu.
![Navigate to Account Information]()
If your **API Key** and **Secret Key** are already available, proceed to step 2.
Otherwise, check the **Generate New API Credentials** then click the **Save** button to generate the new API credentials.
![Generate API Credentials]()
After creation, copy your API key and secret key.
![Generated API Token]()
Keep your API key and secret key secure and do not share it.
Anyone with access to this token can manage your DNS Made Easy resources.
## Setup DNS Made Easy Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**. ![App
Connections Tab]()
Select the **DNS Made Easy Connection** option from the connection options
modal. ![Select DNS Made Easy
Connection]()
Enter your DNS Made Easy API key and secret key in the provided fields and
click **Connect to DNS Made Easy** to establish the connection. ![Connect to
DNS Made
Easy]()
Your **DNS Made Easy Connection** is now available for use in your Infisical
projects. ![DNS Made Easy Connection
Created]()
# Doppler Connection
Source: https://infisical.com/docs/integrations/app-connections/doppler
Learn how to configure a Doppler Connection for Infisical.
Infisical supports the use of API Tokens to connect with Doppler. This connection is used for importing secrets from Doppler into Infisical via the [external migration tool](/docs/documentation/platform/external-migrations/doppler).
## Create a Doppler API Token
Log in to your Doppler account and go to the Tokens tab.
![Doppler Dashboard]()
In the User Tokens page, click in **Manage service accounts** .
![Doppler Service Accounts]()
Click in the "+" icon, provide a descriptive name, and confirm creation.
![Doppler Create Token]()
Click the pencil icon next to your service account role to modify the role of the service account.
![Doppler Service Account Role]()
For the best migration experience, we recommend that you give the service account full access to all your projects in order to migrate from all projects within Doppler.
![Doppler Service Account Role]()
Click in the "+" icon in the Service Account API Tokens container
![Doppler Token Created]()
Add a name for the API Token and click in Create API Token
![Doppler Token Created]()
Copy the generated token and save it, you will need it in the nexts steps
![Doppler Token Created]()
## Create a Doppler Connection in Infisical
In your Infisical dashboard, navigate to **Organization Settings** and select the **App Connections** tab.
![App Connections Tab]()
Click **+ Add Connection** and choose **Doppler Connection** from the list of available connections.
![Select Doppler Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* The API Token value from the previous step
![Doppler Connection Form]()
After submitting the form, your **Doppler Connection** will be successfully created and ready to use for importing secrets into Infisical.
![Doppler Connection Created]()
To create a Doppler Connection via API, send a request to the [Create Doppler Connection](/docs/api-reference/endpoints/app-connections/doppler/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/doppler \
--header 'Content-Type: application/json' \
--data '{
"name": "my-doppler-connection",
"method": "api-token",
"credentials": {
"apiToken": "[API TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c2a1b4d-97e6-4f18-b3c2-8e5d9a0f1234",
"name": "my-doppler-connection",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "9a1e482fbc306g93b1d6e2ce0d081b340dfcbg99f005b7c506f3ecd1391772g0",
"app": "doppler",
"method": "api-token",
"credentials": {}
}
}
```
# Infisical Connection
Source: https://infisical.com/docs/integrations/app-connections/external-infisical
Learn how to configure an Infisical Connection to sync secrets between Infisical instances.
Infisical supports connecting to a remote Infisical instance using a **Machine Identity** (Universal Auth).
This enables you to sync secrets from one Infisical project to another — for example, from your cloud instance to a self-hosted deployment.
## Setup Infisical Connection in Infisical
Open the **remote** Infisical instance (the one you want to sync secrets *to*) and navigate to **Organization** > **Access Control** > **Machine Identities**.
![Machine Identities Tab]()
Create a new Machine Identity. Give it a descriptive name (e.g., `infisical-sync-identity`).
![Create Machine Identity]()
Select **Universal Auth** as the authentication method and create the identity.
![Configure Universal Auth]()
Copy the **Client ID**. Then click **Create Client Secret** and copy the generated secret. Store both values in a secure location — the secret will not be shown again.
![Copy Client Credentials]()
Navigate to the project on the remote instance that you want to sync secrets to. Under **Project Settings** > **Access Control** > **Machine Identities**, add the Machine Identity you created and grant it a role with write permission on secrets (e.g. **Member** or a custom role with secret write access).
![Add Identity to Project]()
Switch back to your **source** Infisical instance. Navigate to **Organization** > **App Connections** and click **Add Connection**.
![App Connections Tab]()
Choose the **Infisical** option from the connection list.
![Select Infisical Connection]()
Complete the connection form with the following details:
* **Instance URL**: The base URL of the remote Infisical instance (e.g., `https://infisical.example.com`).
* **Machine Identity Client ID**: The Client ID copied in a previous step.
* **Machine Identity Client Secret**: The Client Secret copied in a previous step.
![Infisical Connection Form]()
Your **Infisical Connection** is now available for use in Secret Syncs.
![Connection Created]()
To create an Infisical Connection, make an API request to the [Create Infisical Connection](/docs/api-reference/endpoints/app-connections/external-infisical/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/external-infisical \
--header 'Content-Type: application/json' \
--data '{
"name": "my-infisical-connection",
"method": "machine-identity-universal-auth",
"credentials": {
"instanceUrl": "https://infisical.example.com",
"machineIdentityClientId": "",
"machineIdentityClientSecret": ""
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-infisical-connection",
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-01T05:31:56Z",
"updatedAt": "2025-04-01T05:31:56Z",
"app": "external-infisical",
"method": "machine-identity-universal-auth",
"credentials": {
"instanceUrl": "https://infisical.example.com",
"machineIdentityClientId": ""
}
}
}
```
# F5 BIG-IP Connection
Source: https://infisical.com/docs/integrations/app-connections/f5-big-ip
Learn how to configure an F5 BIG-IP Connection for Infisical.
Infisical supports connecting to F5 BIG-IP LTM appliances via the iControl REST API for managing SSL certificates and binding them to Client SSL or Server SSL profiles.
## Setup
You will need the following from your F5 BIG-IP appliance:
* **Hostname**: The management IP address or FQDN of your BIG-IP appliance (e.g. `10.10.10.10` or `bigip.example.com`).
* **Port**: The HTTPS management port (default: `443`).
* **Username**: A user with administrative access to manage SSL certificates and profiles.
* **Password**: The password for the user account.
The user account must be assigned a role with permissions to:
* Upload files via the iControl REST file-transfer endpoint.
* Create, update, and delete `sys file ssl-cert` and `sys file ssl-key` objects.
* Update `ltm profile client-ssl` or `ltm profile server-ssl` objects (only required if profile binding is used).
* Save the running configuration.
The built-in **Certificate Manager** role meets these requirements when paired with the relevant administrative partition. For broader scopes, **Resource Administrator** or **Administrator** can be used.
In the Infisical dashboard, navigate to **Organization Settings** > **App Connections** and click **Add Connection**.
Select the **F5 BIG-IP** option from the list of available connections.
Fill in the **Configuration** tab:
* **Hostname**: The management IP or FQDN of the BIG-IP appliance.
* **Username**: The BIG-IP management username.
* **Password**: The password for the management user.
* **Port** (Optional): HTTPS port for the management interface (default: `443`).
Configure the **SSL** tab:
* **SSL Certificate** (Optional): A CA certificate in PEM format to verify the BIG-IP management interface's TLS certificate.
* **Reject Unauthorized**: When enabled, Infisical will only connect if the BIG-IP has a valid, trusted TLS certificate. Disable for self-signed certificates or provide a CA certificate.
Optionally select a **Gateway** to route the connection through an [Infisical Gateway](/docs/documentation/platform/gateways/overview) when the BIG-IP is hosted in an air-gapped or private network.
Click **Connect to F5 BIG-IP** to validate and save your connection.
Your F5 BIG-IP Connection is now available for use with certificate syncs.
To create an F5 BIG-IP Connection, make an API request to the [Create App Connection](/docs/api-reference/endpoints/app-connections/f5-big-ip/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/f5-big-ip \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-f5-big-ip-connection",
"method": "basic-auth",
"credentials": {
"hostname": "bigip.example.com",
"port": 443,
"username": "admin",
"password": "your-password",
"sslRejectUnauthorized": false
}
}'
```
### Sample response
```json Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-f5-big-ip-connection",
"app": "f5-big-ip",
"method": "basic-auth",
"credentials": {
"hostname": "bigip.example.com",
"port": 443,
"username": "admin",
"sslRejectUnauthorized": false
}
}
}
```
# Fireworks Connection
Source: https://infisical.com/docs/integrations/app-connections/fireworks
Learn how to configure a Fireworks AI connection for Infisical.
[Fireworks AI](https://fireworks.ai/) is an AI inference platform for running and fine-tuning large language models. Infisical supports connecting to Fireworks using an **API Key** and **Account ID**.
## Prerequisites
* A [Fireworks AI](https://fireworks.ai/) account with API access.
* An **API Key** with permissions to create and delete API keys for the target service account.
* Your **Account ID**, which can be found in your Fireworks account settings.
## Create a Fireworks API Key
In your [Fireworks AI account](https://app.fireworks.ai/), click **Settings** in the left sidebar.
![Fireworks Settings]()
In the Settings sidebar, click **API Keys**.
![Fireworks API Keys Nav]()
Click **+ Create API Key** and select **API Key** from the dropdown.
![Fireworks Create API Key]()
Give the key a name and generate it. Copy the generated API key and store it securely. This value is viewable one time only, you will need it when creating the Infisical connection.
![Fireworks Copy API Key]()
Click the account dropdown in the top-right corner and copy your **Account ID** using the copy button. You will also need this when creating the connection.
![Fireworks Account ID]()
## Setup Fireworks Connection in Infisical
Navigate to the **App Connections** tab in your organization and click **+ Add Connection**. Select the **Fireworks** option.
![Select Fireworks Connection]()
Fill in the connection **Name**, select the **API Key** method, paste the **Account ID** and **API Key** you copied earlier, and click **Connect to Fireworks**.
![Create Fireworks Connection]()
Your **Fireworks Connection** is now available for use with [Fireworks API Key Secret Rotation](/docs/documentation/platform/secret-rotation/fireworks-api-key).
![Fireworks Connection Created]()
# Fly.io Connection
Source: https://infisical.com/docs/integrations/app-connections/flyio
Learn how to configure a Fly.io Connection for Infisical.
Infisical supports the use of [Access Tokens](https://fly.io/docs/security/tokens/) to connect with Fly.io.
## Create Fly.io Access Token
![Dashboard Page]()
![Click Create Token]()
Ensure that you give this token access to the correct app, then click 'Create Token'.
![Create Token Page]()
After clicking 'Create Token', a modal containing your access token will appear. Save this token for later steps.
## Create Fly.io Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **Fly.io Connection** option from the available integrations.
![Select Fly.io Connection]()
Complete the Fly.io Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The Access Token from earlier steps
![Fly.io Connection Modal]()
After clicking Create, your **Fly.io Connection** is established and ready to use with your Infisical project.
![Fly.io Connection Created]()
To create a Fly.io Connection, make an API request to the [Create Fly.io Connection](/docs/api-reference/endpoints/app-connections/flyio/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/flyio \
--header 'Content-Type: application/json' \
--data '{
"name": "my-flyio-connection",
"method": "access-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"accessToken": "[PRIVATE TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-flyio-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "flyio",
"method": "access-token",
"credentials": {}
}
}
```
# GCP Connection
Source: https://infisical.com/docs/integrations/app-connections/gcp
Learn how to configure a GCP Connection for Infisical.
Infisical supports [service account impersonation](https://cloud.google.com/iam/docs/service-account-impersonation) to connect with your GCP projects.
Using the GCP integration on a self-hosted instance of Infisical requires configuring a service account on GCP and
configuring your instance to use it.
Enable the IAM Service Account Credentials API for the project containing the service account that will be impersonated. You can do this from the Google Cloud Console or via the command line.
![Service Account API]()
To enable via command line, run the following command, replacing `projectId` with your GCP project ID:
```bash theme={"dark"}
gcloud services enable iamcredentials.googleapis.com --project=projectId
```
Verify the API is enabled by running:
```bash theme={"dark"}
gcloud services list --enabled --project=projectId | grep iamcredentials
```
![Service Account IAM Page]()
Create a new service account that will be used to impersonate other GCP service accounts for your app connections.
![Create Service Account Page]()
Press "DONE" after creating the service account.
Download the JSON key file for your service account. This will be used to authenticate your instance with GCP.
![Service Account Credential Page]()
1. Copy the entire contents of the downloaded JSON key file.
2. Set it as a string value for the `INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL` environment variable.
3. Restart your Infisical instance to apply the changes.
4. You can now use GCP integration with service account impersonation.
Workload identity federation is also supported. Instead of a service account key, you may
set `INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL` to an `external_account` credential
configuration JSON (the file produced by `gcloud iam workload-identity-pools create-cred-config`).
Infisical detects the credential type from the `type` field automatically. The federated identity
needs the `roles/iam.serviceAccountTokenCreator` role on the service accounts it impersonates.
For **AWS** providers, Infisical resolves the instance's AWS credentials through the standard AWS
SDK credential chain, so federation works on EC2, ECS/Fargate, EKS (IRSA), and Lambda, or from
`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` environment variables. The region defaults to
`us-east-1`; set `AWS_REGION` (or `AWS_DEFAULT_REGION`) to use a specific regional STS endpoint.
For other providers, the referenced credential source (a mounted file or URL) must be reachable
from the Infisical instance at runtime.
## Configure Service Account for Infisical
![Service Account Page]()
Create a new service account with an ID that follows this requirement:
Your service account ID must end with the first two sections of your Infisical organization ID.
Example:
* Infisical organization ID: `df92581a-0fe9-42b5-b526-0a1e88ec8085`
* Required service account ID suffix: `df92581a-0fe9`
![Create Service Account]()
Add the required permissions for secret syncs:
![Assign Service Account Permission]()
After configuring the appropriate roles, press "DONE".
To enable service account impersonation, you'll need to grant the **Service Account Token Creator** role to the Infisical instance's service account. This configuration allows Infisical to securely impersonate the new service account.
1. Navigate to the **IAM & Admin > Service Accounts** section in your Google Cloud Console.
2. Select the newly created service account.
3. Click on the **PERMISSIONS** tab.
4. Click **Grant Access** to add a new principal.
5. In the **New principals** field, enter the Infisical service account email for your environment:
* **Infisical Cloud US:** `infisical-us@infisical-us.iam.gserviceaccount.com`
* **Infisical Cloud EU:** `infisical-eu@infisical-eu.iam.gserviceaccount.com`
* **Self-hosted:** use the service account you created for your instance (the one whose credentials are set in `INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL`).
6. In the **Role** field, select **Service Account Token Creator**.
7. Click **Save**.
![Service Account Page]()
**Troubleshooting: "One or more users named in the policy do not belong to a permitted customer."**
If granting access fails with the error *"One or more users named in the policy do not belong to a permitted customer."*, your Google Cloud organization has the Domain Restricted Sharing organization policy (`iam.allowedPolicyMemberDomains`) enabled. This policy only permits identities that belong to allowlisted Google organizations, so the Infisical service account is rejected until it is explicitly allowed.
To resolve this, add Infisical's Google Cloud Customer ID to the policy's allowed values **before** granting the service account a role:
1. In the Google Cloud Console, navigate to **IAM & Admin > Organization Policies**.
2. Search for and open the **Domain restricted sharing** (`iam.allowedPolicyMemberDomains`) policy.
3. Under **Custom values**, add a new allowed value containing Infisical's Google Cloud Customer ID:
```
C03rsjmyl
```
This is **Infisical's Google Cloud Customer ID**, not your own. Infisical uses a single Google Cloud organization, so this one Customer ID covers both the US and EU service accounts.
Enter the bare Customer ID (`C03rsjmyl`) in the Console UI. If you manage this policy with `gcloud`, a policy YAML file, or Terraform instead, use the prefixed form `is:C03rsjmyl`.
4. Save the policy, then return to **Step 4 (Grant Access)** in the main instructions above and complete steps 4–7 to add the Infisical service account as a principal.
## Setup GCP Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**. ![App Connections
Tab]()
Select the **GCP Connection** option from the connection options modal.
![Select GCP
Connection]()
Select the **Service Account Impersonation** method and click **Connect to
GCP**. ![Connect via GCP
impersonation]()
Your **GCP Connection** is now available for use. ![Impersonation GCP
Connection]()
# GitHub Connection
Source: https://infisical.com/docs/integrations/app-connections/github
Learn how to configure a GitHub Connection for Infisical.
Infisical supports three methods for connecting to GitHub.
Infisical will use a GitHub App with finely grained permissions to connect to GitHub.
Using the GitHub integration with app authentication on a self-hosted instance of Infisical requires configuring an application on GitHub
and registering your instance with it.
Navigate to the GitHub app settings [here](https://github.com/settings/apps). Click **New GitHub App**.
![integrations github app create]()
Give the application a name, a homepage URL (your self-hosted domain i.e. `https://your-domain.com`), and a callback URL (i.e. `https://your-domain.com/organization/app-connections/github/oauth/callback`).
![integrations github app basic details]()
Enable request user authorization during app installation.
![integrations github app enable auth]()
Disable webhook by unchecking the Active checkbox.
![integrations github app webhook]()
Set the repository permissions as follows: Metadata: Read-only, Secrets: Read and write, Environments: Read and write, Actions: Read.
![integrations github app repository]()
Similarly, set the organization permissions as follows: Secrets: Read and write.
![integrations github app organization]()
Create the Github application.
![integrations github app create confirm]()
If you have a GitHub organization, you can create an application under it
in your organization Settings > Developer settings > GitHub Apps > New GitHub App.
Generate a new **Client Secret** for your GitHub application.
![integrations github app create secret]()
Generate a new **Private Key** for your Github application.
![integrations github app create private key]()
Obtain the necessary Github application credentials. This would be the application slug, client ID, app ID, client secret, and private key.
![integrations github app credentials]()
Back in your Infisical instance, you can configure the GitHub App credentials in one of two ways:
**Option 1: Server Admin Panel (Recommended)**
Navigate to the server admin panel > **Integrations** > **GitHub App** and enter the GitHub application credentials:
![integrations github app admin panel]()
* **Client ID**: The Client ID of your GitHub application
* **Client Secret**: The Client Secret of your GitHub application
* **App Slug**: The Slug of your GitHub application (found in the URL)
* **App ID**: The App ID of your GitHub application
* **Private Key**: The Private Key of your GitHub application
**Option 2: Environment Variables**
Alternatively, you can add the new environment variables for the credentials of your GitHub application:
* `INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID`: The **Client ID** of your GitHub application.
* `INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET`: The **Client Secret** of your GitHub application.
* `INF_APP_CONNECTION_GITHUB_APP_SLUG`: The **Slug** of your GitHub application. This is the one found in the URL.
* `INF_APP_CONNECTION_GITHUB_APP_ID`: The **App ID** of your GitHub application.
* `INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY`: The **Private Key** of your GitHub application.
* `INF_APP_CONNECTION_GITHUB_APP_HOST` *(GitHub Enterprise Server only)*: The hostname of the GitHub instance where the shared GitHub App is registered (e.g. `github.mycompany.com`). Only required when the shared app is registered on a GHES instance. Defaults to `github.com`.
If your shared GitHub App is registered on a GitHub Enterprise Server instance, you must set `INF_APP_CONNECTION_GITHUB_APP_HOST` to that instance's hostname. Without it, the OAuth exchange will be directed to `github.com` instead of your GHES host.
Once configured, you can use the GitHub integration via app authentication. If you configured the credentials using environment variables, restart your Infisical instance for the changes to take effect. If you configured them through the server admin panel, allow approximately 5 minutes for the changes to propagate.
## Setup GitHub Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **GitHub Connection** option from the connection options modal.
![Select GitHub Connection]()
Select the **GitHub App** method.
Choose which GitHub App to use for the connection:
* **Instance** — the instance-default GitHub App configured by your Infisical server admin.
* **Private** — a GitHub App registered under your organization. Select an existing one from the list, or click the gear to manage your private apps.
GitHub Apps are scoped to where they were created: apps created from the organization's App Connections page are available to organization-level connections and to every project, while apps created from a project's App Connections page are only available within that project. The shared instance-default app is available in both scopes.
![Select GitHub App]()
When managing your apps, you can inspect them on GitHub, delete existing apps, or click **Create New GitHub App** to register a new app directly from Infisical using GitHub’s App Manifest flow. New apps are automatically configured with the required permissions and callback URLs.
![Manage GitHub Apps]()
![Create New GitHub App]()
You may optionally enable **GitHub Enterprise** to configure enterprise-specific options:
* **Instance Type:** Enterprise Cloud or Enterprise Server
* **Instance Hostname:** The hostname of your GitHub Enterprise instance (e.g. `github.mycompany.com`)
* **Gateway:** The gateway connected to your private network (Enterprise Server only)
Click **Connect to GitHub** when ready.
You will then be redirected to the GitHub app installation page.
Install and authorize the GitHub application. This will redirect you back to Infisical's App Connections page.
![Install GitHub App]()
Your **GitHub Connection** is now available for use.
![Assume Role AWS Connection]()
Infisical will use an OAuth App to connect to GitHub.
Using the GitHub integration on a self-hosted instance of Infisical requires configuring an OAuth application in GitHub
and registering your instance with it.
Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
![integrations github config]()
![integrations github config]()
![integrations github config]()
Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
and the **Authorization callback URL** to `https://your-domain.com/organization/app-connections/github/oauth/callback`.
![integrations github config]()
If you have a GitHub organization, you can create an OAuth application under it
in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
![integrations github config]()
Back in your Infisical instance, add two new environment variables for the credentials of your GitHub OAuth application:
* `INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_ID`: The **Client ID** of your GitHub OAuth application.
* `INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_SECRET`: The **Client Secret** of your GitHub OAuth application.
Once added, restart your Infisical instance and use the GitHub integration.
## Setup GitHub Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **GitHub Connection** option from the connection options modal.
![Select GitHub Connection]()
Select the **OAuth** method and click **Connect to GitHub**.
![Connect via GitHub App]()
You will then be redirected to the GitHub to grant Infisical access to your GitHub account (organization and repo privileges).
Once granted, you will redirect you back to Infisical's App Connections page.
![GitHub Authorization]()
Your **GitHub Connection** is now available for use.
![Assume Role AWS Connection]()
Infisical will use a Personal Access Token to connect to GitHub.
## Create a Personal Access Token
Navigate to your user Settings > Developer settings > Personal Access Tokens to create a new Personal Access Token.
![integrations github config]()
![integrations github config]()
![integrations github config]()
Click **Generate new token** to create the token.
Fill in the Personal Access Token details:
* **Token name:** A descriptive name for the token (e.g., "infisical-connection-token")
* **Repository access:** Select the repositories you want to grant access to
* Select `All repositories` or `Only selected repositories` to be able to manage the secrets in the selected repositories.
* **Select scopes:** Add the following scopes:
* **Metadata**: Read-only
* **Environments**: Read and write
* **Secrets**: Read and write
![Personal Access Token Form]()
Click **Generate token** to create the token.
Copy the generated token immediately as it won't be shown again.
![Personal Access Token Generated]()
Keep your Personal Access Token secure and do not share it. Anyone with access to this token can access your GitHub account and repositories.
## Setup GitHub Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **GitHub Connection** option from the connection options modal.
![Select GitHub Connection]()
Select the **Personal Access Token** method and fill in the **Personal Access Token** field with your Personal Access Token.
You may optionally configure GitHub Enterprise options:
* **Gateway:** The gateway connected to your private network
* **Hostname:** The hostname at which to access your GitHub Enterprise instance
Click **Create Connection**.
![Personal Access Token]()
Your **GitHub Connection** is now available for use.
![Personal Access Token Connection]()
# GitHub Radar Connection
Source: https://infisical.com/docs/integrations/app-connections/github-radar
Learn how to configure a GitHub Radar Connection for Infisical.
Infisical supports GitHub App installation for creating a GitHub Radar Connection.
GitHub Radar Connections are specifically configured for [Secret Scanning](/docs/documentation/platform/secret-scanning/overview) and require specific permissions and webhook configuration.
Check out our [GitHub Connection](/docs/integrations/app-connections/github) for secret management features such as [Secret Syncs](/docs/integrations/secret-syncs/overview).
Using a GitHub Radar Connection with app authentication on a self-hosted instance of Infisical requires configuring an application on GitHub
and registering your instance with it.
Navigate to the GitHub App Settings [here](https://github.com/settings/apps). Click **New GitHub App**.
If you have a GitHub organization, you can create an application under it
in your organization Settings > Developer settings > GitHub Apps > New GitHub App.
![create github radar app]()
Configure the following fields:
1. **Name** - give your app a name
2. **Homepage URL** - your self-hosted domain (i.e. `https://your-domain.com`)
3. **Callback URL** - the callback URL for your domain (i.e. `https://your-domain.com/organization/app-connections/github-radar/oauth/callback`)
4. **User Authorization** - enable request user authorization on app installation
![github radar app details]()
Enable and configure the Webhook fields:
* **Webhook URL** - the webhook URL for your domain (i.e. `https://your-domain.com/secret-scanning/webhooks/github`)
* **Webhook Secret** - a strong, generated secret to verify webhook payloads
* **SSL Verification** - enable SSL verification
![github radar app webhook]()
Set the following repository permissions:
* **Contents**: `Read-only`
* **Metadata**: `Read-only`
![github radar app permissions 1]()
![github radar app permissions 2]()
Subscribe to the following events:
* **Push**
![github radar app events]()
Create the Github application.
![github radar app complete]()
Generate a new **Client Secret** for your GitHub application.
![github radar app client secret]()
Generate a new **Private Key** for your Github application.
You will need to copy the contents of the .pem file downloaded
![github radar app private key]()
Obtain the following credentials:
1. **Slug** - the slug of your application found in the URL
2. **App ID** - the ID of your application
3. **Client ID** - the client ID of your application
4. **Client Secret** - the client secret generated above
5. **Private Key** - the contents of the private key .pem file generated above
6. **Webhook Secret** - the secret generated in the previous step when configuring the webhook
![github radar app credentials]()
Back in your Infisical instance, add the six new environment variables for the credentials of your GitHub Radar application:
* `INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_ID`: The **Client ID** of your GitHub application.
* `INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_SECRET`: The **Client Secret** of your GitHub application.
* `INF_APP_CONNECTION_GITHUB_RADAR_APP_SLUG`: The **Slug** of your GitHub application. This is the one found in the URL.
* `INF_APP_CONNECTION_GITHUB_RADAR_APP_ID`: The **App ID** of your GitHub application.
* `INF_APP_CONNECTION_GITHUB_RADAR_APP_PRIVATE_KEY`: The **Private Key** of your GitHub application.
* `INF_APP_CONNECTION_GITHUB_RADAR_APP_WEBHOOK_SECRET`: The **Webhook Secret** of your GitHub application.
Once added, restart your Infisical instance and use the GitHub integration via app authentication.
## Setup GitHub Radar Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **GitHub Radar Connection** option from the connection options modal.
![Select GitHub Radar Connection]()
Select the **GitHub App** method and click **Connect to GitHub**.
![Connect via GitHub App]()
You will then be redirected to the GitHub App installation page.
Install and authorize the GitHub application. This will redirect you back to Infisical's App Connections page.
![Install GitHub App]()
Your **GitHub Radar Connection** is now available for use.
![GitHub Radar Connection]()
# GitLab Connection
Source: https://infisical.com/docs/integrations/app-connections/gitlab
Learn how to configure a GitLab Connection for Infisical using OAuth or Access Token methods.
Infisical supports two methods for connecting to GitLab: **OAuth** and **Access Token**. Choose the method that best fits your setup and security requirements.
The OAuth method provides secure authentication through GitLab's OAuth flow.
Oauth Method is only supported in Self-Hosted mode.
Using the GitLab Connection with OAuth on a self-hosted instance of Infisical requires configuring an OAuth application in GitLab and registering your instance with it.
If you're self-hosting GitLab with custom certificates, you will have to configure your Infisical instance to trust these certificates. To learn how, please follow [this guide](../../self-hosting/guides/custom-certificates).
**Prerequisites:**
* A GitLab account with existing projects
* Self-hosted Infisical instance
Navigate to your user Settings > Applications to create a new GitLab application.
![GitLab Dashboard]()
![GitLab Applications Settings]()
Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/gitlab/oauth/callback`.
Depending on your use case, add one or more of the following scopes to your application:
For Secret Syncs, your application will require the `api` scope:
![GitLab New Application Form]()
![GitLab New Application Form]()
For Secret Scanning, your application will require the `api` and `read_repository` scopes:
![GitLab New Application Form]()
![GitLab New Application Form]()
The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
If you have a GitLab group, you can create an OAuth application under it in your group Settings > Applications.
Obtain the **Application ID** and **Secret** for your GitLab OAuth application.
![GitLab Application Credentials]()
Back in your Infisical instance, add two new environment variables for the credentials of your GitLab OAuth application:
* `INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID`: The **Application ID** of your GitLab OAuth application.
* `INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET`: The **Secret** of your GitLab OAuth application.
Once added, restart your Infisical instance and use the GitLab Connection.
## Setup GitLab OAuth Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **GitLab Connection** option from the connection options modal.
![Select GitLab Connection]()
Select the **OAuth** method and click **Connect to GitLab**.
![Connect via GitLab OAuth]()
You will be redirected to GitLab to grant Infisical access to your GitLab account. Once granted, you will be redirected back to Infisical's App Connections page.
![GitLab Authorization]()
Your **GitLab Connection** is now available for use.
![GitLab OAuth Connection]()
The Access Token method uses a GitLab access token for authentication, providing a straightforward setup process.
## Generate GitLab Access Token
Personal access tokens provide access to your GitLab account and all projects you have access to.
Log in to your GitLab account and navigate to User Settings > Access tokens. Click **Add new token** to create a new personal access token.
![GitLab Personal Access Tokens]()
Fill in the token details:
* **Token name**: A descriptive name for the token (e.g., "connection-token")
* **Expiration date**: Set an appropriate expiration date
* **Select scopes**: Depending on your use case, add one or more of the following scopes:
For Secret Syncs, your token will require the `api` scope:
![GitLab Personal Token Form]()
For Secret Scanning, your token will require the `api` and `read_repository` scopes:
![GitLab Personal Token Form]()
Personal Access Token connections require manual token rotation when your GitLab access token expires or is regenerated. Monitor your connection status and update the token as needed.
Copy the generated token immediately as it won't be shown again.
![GitLab Personal Token Created]()
Keep your access token secure and do not share it. Anyone with access to this token can access your GitLab account and projects.
Project access tokens provide access to a specific GitLab project, offering more granular control.
Go to your GitLab project and navigate to Settings > Access Tokens. Click **Add new token** to create a new project access token.
![GitLab Project Access Tokens]()
Fill in the token details:
* **Token name**: A descriptive name for the token
* **Expiration date**: Set an appropriate expiration date
* **Select role and scopes**: Depending on your use case, add the required role and one or more of the following scopes:
For Secret Syncs, your token will require the `api` scope and at least the **Owner** role:
![GitLab Create Project Token]()
For Secret Scanning, your token will require the `api` and `read_repository` scopes and the **Maintainer** role:
![GitLab Create Project Token]()
Project Access Token connections require manual token rotation when your GitLab access token expires or is regenerated. Monitor your connection status and update the token as needed.
Copy the generated token immediately as it won't be shown again.
![GitLab Project Token Form]()
Keep your access token secure and do not share it. Anyone with access to this token can access your GitLab account and projects.
Group access tokens provide access to all projects within a GitLab group, offering group-level control.
Go to your GitLab group and navigate to Settings > Access Tokens. Click **Add new token** to create a new group access token.
![GitLab Group Access Tokens]()
Fill in the token details:
* **Token name**: A descriptive name for the token
* **Expiration date**: Set an appropriate expiration date
* **Select role and scopes**: Depending on your use case, add the required role and one or more of the following scopes:
For Secret Syncs, the required role depends on your sync destination:
* **Project variables**: Requires **Maintainer** role or higher
* **Group variables**: Requires **Owner** role
Your token will require the `api` scope.
![GitLab Create Group Token]()
Click **Create group access token** to create the token.
Use the **Owner** role if you need to sync to group-level variables. The **Maintainer** role is sufficient only for project-level variables.
To set up Secret Scanning, the required permissions depend on the data source level:
* **Project-level data source:** Requires **Maintainer** role or higher
* **Group-level data source:** Requires **Owner** role
Your token will require the `api` scope.
![GitLab Create Group Token]()
Click **Create group access token** to create the token.
Group Access Token connections require manual token rotation when your GitLab access token expires or is regenerated. Monitor your connection status and update the token as needed.
Copy the generated token immediately as it won't be shown again.
![GitLab Group Token Created]()
Keep your access token secure and do not share it. Anyone with access to this token can access all projects within your GitLab group.
## Setup GitLab Access Token Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **GitLab Connection** option from the connection options modal.
![Select GitLab Connection]()
Select the **Access Token** method, paste your GitLab access token in the provided field, and select the appropriate token type.
![Configure Access Token]()
Click **Connect** to establish the connection.
Your **GitLab Connection** is now available for use.
![GitLab Access Token Connection]()
# GoDaddy Connection
Source: https://infisical.com/docs/integrations/app-connections/godaddy
Learn how to configure a GoDaddy connection for Infisical.
Infisical supports connecting to the [GoDaddy Certificates API](https://developer.godaddy.com/doc/endpoint/certificates) using a **GoDaddy API Key and Secret**. This connection powers the [GoDaddy Certificate Authority](/docs/documentation/platform/pki/ca/godaddy) for issuing Domain Validated (DV) certificates.
Only **production** GoDaddy API credentials are supported. GoDaddy's OTE (test) environment
cannot issue certificates without a provisioned product, so Infisical always targets
`api.godaddy.com`.
## Prerequisites
* A GoDaddy account with API access
* A **production** API Key and Secret (the first key you create on GoDaddy is an OTE/test key, so create a separate production key)
## Create a GoDaddy API Key
Sign in to your GoDaddy account and go to [developer.godaddy.com/keys](https://developer.godaddy.com/keys).
Click **Create New API Key**, give it a name (e.g. `infisical`), and select **Production** under **Environment**. Click **Next**.
Copy both the **Key** and the **Secret**. The secret is shown only once.
Create a dedicated API key for Infisical rather than reusing an existing one so you can rotate or
revoke access independently.
## Create GoDaddy Connection in Infisical
In your Infisical dashboard, go to **Organization Settings** → **App Connections**.
![App Connections Tab]()
Click **Add Connection** and choose **GoDaddy** from the list of available connections.
Complete the form with:
* A **name** for the connection (e.g. `godaddy-prod`)
* An optional **description**
* Your GoDaddy **API Key**
* Your GoDaddy **API Secret**
After clicking **Create**, Infisical validates the credentials against the GoDaddy
Certificates API. Once confirmed, the connection is ready to use in a GoDaddy Certificate
Authority.
To create a GoDaddy Connection, make an API request to the [Create GoDaddy Connection](/docs/api-reference/endpoints/app-connections/godaddy/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/godaddy \
--header 'Content-Type: application/json' \
--data '{
"name": "my-godaddy-connection",
"method": "api-key",
"credentials": {
"apiKey": "",
"apiSecret": ""
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-godaddy-connection",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2026-06-01T00:00:00.000Z",
"updatedAt": "2026-06-01T00:00:00.000Z",
"isPlatformManagedCredentials": false,
"app": "godaddy",
"method": "api-key",
"credentials": {}
}
}
```
# Hashicorp Vault Connection
Source: https://infisical.com/docs/integrations/app-connections/hashicorp-vault
Learn how to configure a Hashicorp Vault Connection for Infisical.
Infisical is compatible with Vault Self-hosted, HCP Vault Dedicated, and HCP Vault Enterprise deployments. Please note that HCP Generic Secrets are currently not supported.
Infisical supports two methods for connecting to Hashicorp Vault.
![Vault Access]()
In the **Authentication Methods** tab, click on **Enable new method**.
![Vault Enable Method]()
![Vault AppRole]()
You may change the name of the method, but we suggest keeping it as `approle`.
![Vault Enable Method]()
From the home page, navigate to **Policies**.
![Vault Policies Navigate]()
![Vault Policies Page]()
You may name your policy whatever you want, but remember the name as it will be used in future steps.
Depending on your use case, you may have different policy configurations:
```hcl theme={"dark"}
path "demo_mount/data/*" {
capabilities = [ "create", "read", "update", "delete" ]
}
path "sys/mounts" {
capabilities = ["read"]
}
```
* **demo\_mount**: The name of the target secrets engine (e.g., 'secret', 'kv').
* **data/\***: The path within the secrets engine used for storing secrets. The wildcard (\*) grants access to all secrets within this mount point.
Make sure to replace the policy path with the specific path where you intend to sync your secrets. For better security and control, it's recommended to use a more granular path instead of a wildcard (\*). You can also specify a path that doesn’t yet exist—Infisical will automatically create it for you during the sync process.
![Vault Create Policy]()
**Open Vault Shell**
![Vault Shell]()
If you used custom approle or policy names in previous steps, you'll need to customize the following commands.
**Create Infisical Role**
```hcl theme={"dark"}
vault write auth/approle/role/infisical token_policies="infisical-policy" token_ttl=30s token_max_ttl=2m
```
**Read RoleID**
```hcl theme={"dark"}
vault read auth/approle/role/infisical/role-id
```
**Generate New SecretID**
```hcl theme={"dark"}
vault write -force auth/approle/role/infisical/secret-id
```
Your shell output should look similar to the image below. Save the RoleID and SecretID values for later steps.
![Vault Shell Output]()
## Get a Hashicorp Vault Access Token
Open your profile dropdown and click **Copy token**. This token will be used in later steps.
![Vault Profile Copy Token]()
## Getting Vault Instance URL
For self-hosted instances, locate and copy your vault's base URL (for example: `https://vault.example.com`).
Save the URL for later steps.
On HCP instances, you may need to navigate to **Cluster Overview** to see your cluster URL. Save this value for later steps.
![Vault Cluster URLs]()
Cluster Overview is found in the HCP dashboard, not in your cluster's web UI.
## Setup Vault Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **Hashicorp Vault Connection** option.
![Select Vault Connection]()
Configure your Vault Connection using the Instance URL and credentials from the steps above. **Depending on if you chose to authenticate with an Access Token or AppRole, you may need to input different information.**
![Vault Configure Connection]()
* **Name**: The name of the connection being created. Must be slug-friendly.
* **Description**: An optional description to provide details about this connection.
* **Gateway (optional):** The gateway connected to your private network. All requests made to your Vault instance will be made through the configured gateway.
* **Instance URL**: The URL of your Hashicorp Vault instance.
* **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
* **Role ID**: The Role ID generated in the steps above.
* **Secret ID**: The Secret ID generated in the steps above.
* **Name**: The name of the connection being created. Must be slug-friendly.
* **Description**: An optional description to provide details about this connection.
* **Gateway (optional):** The gateway connected to your private network. All requests made to your Vault instance will be made through the configured gateway.
* **Instance URL**: The URL of your Hashicorp Vault instance.
* **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
* **Access Token**: The Access Token generated in the steps above.
Your Vault Connection is now available for use.
![Vault Connection Created]()
To create a Vault Connection, make an API request to the [Create Hashicorp Vault
Connection](/docs/api-reference/endpoints/app-connections/hashicorp-vault/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/hashicorp-vault \
--header 'Content-Type: application/json' \
--data '{
"name": "my-vault-connection",
"method": "app-role",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"instanceUrl": "https://vault.example.com",
"roleId": "4797c4fa-7794-71f0-c8b1-7c87759df5bf",
"secretId": "ad24df93-19c8-c865-9997-6b8513253d3a"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-vault-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2025-04-01T05:31:56Z",
"updatedAt": "2025-04-01T05:31:56Z",
"app": "hashicorp-vault",
"method": "app-role",
"credentials": {
"instanceUrl": "https://vault.example.com",
"roleId": "4797c4fa-7794-71f0-c8b1-7c87759df5bf"
}
}
}
```
# Hasura Cloud Connection
Source: https://infisical.com/docs/integrations/app-connections/hasura-cloud
Learn how to configure a Hasura Cloud Connection for Infisical.
Infisical supports connecting to Hasura Cloud using a [Personal Access Token](https://hasura.io/docs/2.0/hasura-cloud/account-settings/#access-tokens) to manage your project's environment variables.
## Create a Hasura Cloud Personal Access Token
Log in to [Hasura Cloud](https://cloud.hasura.io), then click **My Account** in the bottom-left corner of the Projects page.
![Hasura Cloud My Account]()
In Account Settings, open the **Access Tokens** tab.
![Hasura Cloud Access Tokens]()
Click **New Access Token**.
![New Hasura Cloud Access Token]()
Enter a descriptive name for the token, then click **Generate**.
![Generate Hasura Cloud Token]()
Click **Copy** and store the token securely for the next steps. The token is revealed only once and cannot be retrieved again.
![Copy Hasura Cloud Token]()
## Create a Hasura Cloud Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **Hasura Cloud Connection** from the list of integrations.
![Select Hasura Cloud Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* The **Method** (Personal Access Token)
* The Personal Access Token from the previous step
Then click **Connect to Hasura Cloud**.
![Hasura Cloud Connection Modal]()
After submitting the form, your **Hasura Cloud Connection** will be successfully created and ready to use with your Infisical project.
![Hasura Cloud Connection Created]()
To create a Hasura Cloud Connection via API, send a request to the [Create Hasura Cloud Connection](/docs/api-reference/endpoints/app-connections/hasura-cloud/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/hasura-cloud \
--header 'Content-Type: application/json' \
--data '{
"name": "my-hasura-cloud-connection",
"method": "access-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"accessToken": "[PERSONAL ACCESS TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-hasura-cloud-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "hasura-cloud",
"method": "access-token",
"credentials": {}
}
}
```
# Heroku Connection
Source: https://infisical.com/docs/integrations/app-connections/heroku
Learn how to configure a Heroku Connection for Infisical using OAuth or Auth Token methods.
Infisical supports two methods for connecting to Heroku: **OAuth** and **Auth Token**. Choose the method that best fits your setup and security requirements.
The OAuth method provides secure authentication through Heroku's OAuth flow.
Using the Heroku Connection with OAuth on a self-hosted instance of Infisical requires configuring an API client in Heroku and registering your instance with it.
**Prerequisites:**
* A Heroku account with existing applications
* Self-hosted Infisical instance
Navigate to your user Account settings > Applications to create a new API client.
![Heroku config settings]()
![Heroku config applications]()
![Heroku config new app]()
Create the API client. As part of the form, set the **OAuth callback URL** to `https://your-domain.com/organization/app-connections/heroku/oauth/callback`.
The domain you defined in the OAuth callback URL should be equivalent to the `SITE_URL` configured in your Infisical instance.
![Heroku config new app form]()
Obtain the **Client ID** and **Client Secret** for your Heroku API client.
![Heroku config credentials]()
Back in your Infisical instance, add two new environment variables for the credentials of your Heroku API client:
* `INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID`: The **Client ID** of your Heroku API client.
* `INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET`: The **Client Secret** of your Heroku API client.
Once added, restart your Infisical instance and use the Heroku Connection.
## Setup Heroku OAuth Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **Heroku Connection** option from the connection options modal.
![Select Heroku Connection]()
Select the **OAuth** method and click **Connect to Heroku**.
![Connect via Heroku OAuth]()
You will be redirected to Heroku to grant Infisical access to your Heroku account. Once granted, you will be redirected back to Infisical's App Connections page.
![Heroku Authorization]()
Your **Heroku Connection** is now available for use.
![Heroku OAuth Connection]()
The Auth Token method uses a Heroku API token for authentication, providing a straightforward setup process.
## Setup Heroku Auth Token Connection in Infisical
Log in to your Heroku account and navigate to Account Settings.
Under the **Authorizations** section on the **Applications** tab, reveal and copy your Authorization token. If you don't have one, click **Create Authorization** to create a new token.
Keep your Authorization token secure and do not share it. Anyone with access to this token can manage your Heroku applications.
![Heroku API Token]()
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **Heroku Connection** option from the connection options modal.
![Select Heroku Connection]()
Select the **Auth Token** method and paste your Heroku Authorization token in the provided field.
![Configure Auth Token]()
Click **Connect** to establish the connection.
Your **Heroku Connection** is now available for use.
![Heroku Auth Token Connection]()
Auth Token connections require manual token rotation when your Heroku Authorization expires or is regenerated. Monitor your connection status and update the token as needed.
# Humanitec Connection
Source: https://infisical.com/docs/integrations/app-connections/humanitec
Learn how to configure a Humanitec Connection for Infisical.
Infisical supports connecting to Humanitec using a service user.
## Setup Humanitec Connection in Infisical
Navigate to the Humanitec **Service Users** tab.
![Humanitec Service Users Tab]()
Create a new service user. Take into account that the role set here will affect the permissions of the API Token so be sure to set it so the Service User has access permissions to the App you want to integrate to Infisical.
![Humanitec Create New Service User]()
Add a new API token for the service user.
![Humanitec Add API Token]()
Create the API token for the service user.
This token's permission will be limited to the **Service User** role.
If you configure an expiry date for your API token you will need to manually rotate to a new token prior to expiration to avoid integration downtime.
![Humanitec Create API Token]()
A modal with the API token will be displayed. Save the token in a secure location for later use in the following steps.
![Humanitec Copy API Token]()
After following the previous steps the Service User has been successfully created, and now should be visible on the Service Users tab.
![Humanitec Service User Created]()
Move to the **Applications** tab and add the Service User to the Application you want to sync with Infisical.
Clicking on the App Title will open the App details page.
![Humanitec Applications Tab]()
Move to the **People** tab and add a new member to this Application. The recently created User Service should be visible on the dropdown shown.
Make sure to assign at least Developer role as Write permissions are required.
![Humanitec Add User to Application]()
![Humanitec Add User Options]()
![Humanitec Add User Role]()
Your **Humanitec Connection** is now available for use.
![Humanitec Connection Created]()
Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Select the **Humanitec Connection** option from the connection options modal.
![Select Humanitec Connection]()
Fill the Humanitec Connection modal, here you will need to provide the User Service API Token generated in the previous step.
![Humanitec Connection Modal]()
Your **Humanitec Connection** is now available for use.
![Humanitec Connection Created]()
# Laravel Forge Connection
Source: https://infisical.com/docs/integrations/app-connections/laravel-forge
Learn how to configure a Laravel Forge Connection for Infisical.
Infisical supports the use of [API Tokens](https://forge.laravel.com/docs/api#create-a-new-api-token) to connect with Laravel Forge.
## Create Laravel Forge API Token
![Laravel Forge User Settings]()
![Applications Tab]()
Provide a name for your token and select the following permissions:
* `user:view`
* `organization:view`
* `server:view`
* `site:manage-environment`
Then click 'Add token'.
![Token Form]()
Make sure to copy the token now—you won’t be able to access it again.
![Token Generated]()
## Create a Laravel Forge Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **Laravel Forge** Connection from the list of integrations.
![Select Laravel Forge Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* The API Token from the previous step
![Laravel Forge Connection Modal]()
After submitting the form, your **Laravel Forge Connection** will be successfully created and ready to use with your Infisical project.
![Laravel Forge Connection Created]()
To create a Laravel Forge Connection via API, send a request to the [Create Laravel Forge Connection](/docs/api-reference/endpoints/app-connections/laravel-forge/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/laravel-forge \
--header 'Content-Type: application/json' \
--data '{
"name": "my-laravel-forge-connection",
"method": "api-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiToken": "[API TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-laravel-forge-connection",
"description": null,
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2025-10-13T10:15:00.000Z",
"updatedAt": "2025-10-13T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "laravel-forge",
"method": "api-token",
"credentials": {}
}
}
```
# LDAP Connection
Source: https://infisical.com/docs/integrations/app-connections/ldap
Learn how to configure an LDAP Connection for Infisical.
Infisical supports the use of [Simple Binding](https://ldap.com/the-ldap-bind-operation) to connect with your LDAP provider.
## Prerequisites
You will need the following information to establish an LDAP connection:
* **LDAP URL** - The LDAP/LDAPS URL to connect to (e.g., ldap\://domain-or-ip:389 or ldaps\://domain-or-ip:636)
* **Binding DN/UPN** - The Distinguished Name (DN), or User Principal Name (UPN) if supported, of the principal to bind with (e.g., 'CN=John,CN=Users,DC=example,DC=com')
* **Binding Password** - The password to bind with for authentication
* **CA Certificate** - The SSL certificate (PEM format) to use for secure connection when using ldaps\:// with a self-signed certificate
Depending on how you intend to use your LDAP connection, there may be additional requirements:
For Password Rotation, the following requirements must additionally be met:
* You must use an LDAPS connection
* The binding user must either have:
* Permission to change other users passwords if rotating directory users' passwords
* Permission to update their own password if rotating their personal password
## Setup LDAP Connection in Infisical
1. Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
2. Select the **LDAP Connection** option.
![Select LDAP Connection]()
3. Select the **Simple Bind** method option and provide the details obtained from the previous section and press **Connect to Provider**.
![Create LDAP Connection]()
4. Your **LDAP Connection** is now available for use.
![Assume Role LDAP Connection]()
To create an LDAP Connection, make an API request to the [Create LDAP
Connection](/docs/api-reference/endpoints/app-connections/ldap/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/ldap \
--header 'Content-Type: application/json' \
--data '{
"name": "my-ldap-connection",
"method": "simple-bind",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"provider": "active-directory",
"url": "ldaps://domain-or-ip:636",
"dn": "CN=John,CN=Users,DC=example,DC=com",
"password": "",
"sslRejectUnauthorized": true,
"sslCertificate": "..."
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-ldap-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "ldap",
"method": "simple-bind",
"credentials": {
"provider": "active-directory",
"url": "ldaps://domain-or-ip:636",
"dn": "CN=John,CN=Users,DC=example,DC=com",
"sslRejectUnauthorized": true,
"sslCertificate": "..."
}
}
}
```
# LiteLLM Connection
Source: https://infisical.com/docs/integrations/app-connections/litellm
Learn how to configure a LiteLLM connection for Infisical.
[LiteLLM](https://www.litellm.ai/) is an open-source LLM gateway that exposes a unified, OpenAI-compatible API in front of hundreds of large language models. Infisical supports connecting to a self-hosted LiteLLM proxy using an **API Key**. This connection is used to manage and rotate LiteLLM API keys via [Secret Rotation](/docs/documentation/platform/secret-rotation/litellm-api-key).
## Prerequisites
* A running **LiteLLM proxy** that Infisical can reach over the network, along with its base URL (e.g. `https://litellm.example.com`).
* A **management-capable API key** for that proxy. Infisical uses this key to create, list, and delete keys on your behalf, so it must be the proxy **master key** or an admin/management key with key-management permissions. A standard virtual key limited to model completions will not work.
See LiteLLM's [Virtual Keys](https://docs.litellm.ai/docs/proxy/virtual_keys) documentation for details on the proxy master key and key management.
## Create LiteLLM Connection in Infisical
We recommend creating a dedicated user and issuing a scoped key for Infisical to manage your API keys, rather than using the master key directly. This restricts Infisical's access to only the routes it needs.
First, create a user with the `proxy_admin` role. This role is required so the key can delete keys it did not issue:
```bash Create user theme={"dark"}
curl --request POST \
--url /user/new \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"user_id": "infisical-user-rotation",
"user_role": "proxy_admin",
"user_alias": "infisical-proxy-admin-client"
}'
```
Then issue a scoped key for that user:
```bash Issue scoped key theme={"dark"}
curl --request POST \
--url /key/generate \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"key_alias": "admin-key-rotation",
"user_id": "infisical-user-rotation",
"allowed_routes": [
"/key/generate",
"/key/delete",
"/key/info",
"/health/readiness",
"/models",
"/v2/team/list",
"/user/list"
]
}' | jq ".key"
```
The `/models`, `/v2/team/list`, and `/user/list` routes are optional. They are only used to populate the user, team, and model dropdowns in the Infisical UI when configuring a rotation.
Use the generated key as your **API Key** and your instance address as the **Instance URL** when creating the connection below.
In your Infisical dashboard, go to **Organization Settings** → **App Connections** (or the **Integrations** → **App Connections** tab in your project).
![App Connections Tab]()
Click **Add Connection** and choose **LiteLLM** from the list of available connections.
![Select LiteLLM Connection]()
Complete the form with:
* A **name** for the connection (e.g. `litellm-prod`)
* An optional **description**
* Your **LiteLLM Instance URL** (e.g. `https://litellm.example.com`)
* Your **LiteLLM API Key** (a management-capable key, as described above)
![LiteLLM Connection Form]()
After clicking **Connect to LiteLLM**, Infisical validates the credentials against your LiteLLM instance. Your **LiteLLM Connection** is then ready to use for [LiteLLM API Key Secret Rotation](/docs/documentation/platform/secret-rotation/litellm-api-key).
![LiteLLM Connection Created]()
Create a LiteLLM connection via the [Create LiteLLM Connection](/docs/api-reference/endpoints/app-connections/litellm/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/litellm \
--header 'Content-Type: application/json' \
--data '{
"name": "my-litellm-connection",
"method": "api-key",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiKey": "",
"instanceUrl": "https://litellm.example.com"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-litellm-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "...",
"app": "litellm",
"method": "api-key",
"credentials": {
"instanceUrl": "https://litellm.example.com"
}
}
}
```
# MongoDB Connection
Source: https://infisical.com/docs/integrations/app-connections/mongodb
Learn how to configure a MongoDB Connection for Infisical.
Infisical supports the use of Username & Password authentication to connect with MongoDB databases.
## Configure a MongoDB user for Infisical
Infisical recommends creating a designated user in your MongoDB database for your connection.
```bash theme={"dark"}
use [TARGET-DATABASE]
db.createUser({
user: "infisical_manager",
pwd: "[ENTER-YOUR-USER-PASSWORD]",
roles: []
})
```
Depending on how you intend to use your MongoDB connection, you'll need to grant one or more of the following permissions.
To learn more about MongoDB's permission system, please visit their [documentation](https://www.mongodb.com/docs/manual/core/security-built-in-roles/).
For Secret Rotations, your Infisical user will require the ability to create, update, and delete users in the target database:
```bash theme={"dark"}
use [TARGET-DATABASE]
db.grantRolesToUser("infisical_manager", [
{ role: "userAdmin", db: "[TARGET-DATABASE]" }
])
```
The `userAdmin` role allows managing users (create, update passwords, delete) within the specified database.
## Create MongoDB Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **MongoDB Connection** option from the available integrations.
![Select MongoDB Connection]()
Complete the MongoDB Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The MongoDB host URL for your database
* The MongoDB port for your database
* The MongoDB username for your database
* The MongoDB password for your database
* The MongoDB database name to connect to
You can optionally configure SSL/TLS for your MongoDB connection in the **SSL** section.
![MongoDB Connection Modal]()
After clicking Create, your **MongoDB Connection** is established and ready to use with your Infisical project.
![MongoDB Connection Created]()
To create a MongoDB Connection, make an API request to the [Create MongoDB Connection](/docs/api-reference/endpoints/app-connections/mongodb/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/mongodb \
--header 'Content-Type: application/json' \
--data '{
"name": "my-mongodb-connection",
"method": "username-and-password",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"host": "[MONGODB HOST]",
"port": 27017,
"username": "[MONGODB USERNAME]",
"password": "[MONGODB PASSWORD]",
"database": "[MONGODB DATABASE]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-mongodb-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "mongodb",
"method": "username-and-password",
"credentials": {
"host": "[MONGODB HOST]",
"port": 27017,
"username": "[MONGODB USERNAME]",
"database": "[MONGODB DATABASE]",
"sslEnabled": false,
"sslRejectUnauthorized": false,
"sslCertificate": ""
}
}
}
```
# Microsoft SQL Server Connection
Source: https://infisical.com/docs/integrations/app-connections/mssql
Learn how to configure a Microsoft SQL Server Connection for Infisical.
Infisical supports connecting to Microsoft SQL Server using database principals.
## Configure a Microsoft SQL Server Principal for Infisical
Infisical recommends creating a designated server login and database user in your Microsoft SQL Server database for your connection.
```SQL theme={"dark"}
-- Create login at the server level
CREATE LOGIN [infisical_app] WITH PASSWORD = 'my-password';
-- Grant server-level connect permission
GRANT CONNECT SQL TO [infisical_app];
-- If you intend to use Platform Managed Credentials (see below)
GRANT ALTER ANY LOGIN TO [infisical_app];
-- Switch to the specific database where you want to create the user
USE my_database;
-- Create the database user mapped to the login
CREATE USER [infisical_app] FOR LOGIN [infisical_app];
```
Depending on how you intend to use your Microsoft SQL Server connection, you'll need to grant one or more of the following permissions.
To learn more about Microsoft SQL Server's permission system, please visit their [documentation](https://learn.microsoft.com/en-us/sql/t-sql/statements/grant-transact-sql?view=sql-server-ver16).
For Secret Rotations, your Infisical user will require the ability to alter other logins' passwords:
```SQL theme={"dark"}
GRANT ALTER ANY LOGIN TO infisical_login;
```
You'll need the following information to create your Microsoft SQL Server connection:
* `host` - The hostname or IP address of your Microsoft SQL Server server
* `port` - The port number your Microsoft SQL Server server is listening on (default: 1433)
* `database` - The name of the specific database you want to connect to
* `username` - The username of the login created in the steps above
* `password` - The password of the login created in the steps above
* `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
## Create Connection in Infisical
1. Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
2. Select the **Microsoft SQL Server Connection** option.
![Select Microsoft SQL Server Connection]()
3. Select the **Username & Password** method option and provide the details obtained from the previous section and press **Connect to Microsoft SQL Server**.
Optionally, if you'd like Infisical to manage the credentials of this connection, you can enable the Platform Managed Credentials option.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
![Create Microsoft SQL Server Connection]()
4. Your **Microsoft SQL Server Connection** is now available for use.
![Assume Role Microsoft SQL Server Connection]()
To create a Microsoft SQL Server Connection, make an API request to the [Create Microsoft SQL Server
Connection](/docs/api-reference/endpoints/app-connections/mssql/create) API endpoint.
Optionally, if you'd like Infisical to manage the credentials of this connection, you can set the `isPlatformManagedCredentials` option to `true`.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/mssql \
--header 'Content-Type: application/json' \
--data '{
"name": "my-mssql-connection",
"method": "username-and-password",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 1433,
"database": "default",
"username": "infisical_login",
"password": "my-password",
"sslEnabled": true,
"sslRejectUnauthorized": true
},
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-mssql-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "mssql",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 1433,
"database": "default",
"username": "infisical_login",
"sslEnabled": true,
"sslRejectUnauthorized": true
}
}
}
```
# MySQL Connection
Source: https://infisical.com/docs/integrations/app-connections/mysql
Learn how to configure a MySQL Connection for Infisical.
Infisical supports connecting to MySQL using a database role.
## Configure a MySQL Role for Infisical
Infisical recommends creating a designated role in your MySQL database for your connection.
```SQL theme={"dark"}
-- create user role
CREATE USER 'infisical_role'@'%' IDENTIFIED BY 'my-password';
```
Depending on how you intend to use your MySQL connection, you'll need to grant one or more of the following permissions.
To learn more about MySQL's permission system, please visit their [documentation](https://dev.mysql.com/doc/refman/8.4/en/grant.html).
For Secret Rotations, your Infisical user will require the ability to alter other users' passwords:
```SQL theme={"dark"}
-- enable permissions to alter login credentials
GRANT CREATE USER ON *.* TO 'infisical_role'@'%';
-- Apply changes
FLUSH PRIVILEGES;
```
You'll need the following information to create your MySQL connection:
* `host` - The hostname or IP address of your MySQL server
* `port` - The port number your MySQL server is listening on (default: 3306)
* `database` - The name of the specific database you want to connect to
* `username` - The role name of the login created in the steps above
* `password` - The role password of the login created in the steps above
* `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
## Create Connection in Infisical
1. Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
2. Select the **MySQL Connection** option.
![Select MySQL Connection]()
3. Select the **Username & Password** method option and provide the details obtained from the previous section and press **Connect to MySQL**.
Optionally, if you'd like Infisical to manage the credentials of this connection, you can enable the Platform Managed Credentials option.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
![Create MySQL Connection]()
4. Your **MySQL Connection** is now available for use.
![Assume Role MySQL Connection]()
To create a MySQL Connection, make an API request to the [Create MySQL Connection](/docs/api-reference/endpoints/app-connections/mysql/create) API endpoint.
Optionally, if you'd like Infisical to manage the credentials of this connection, you can set the `isPlatformManagedCredentials` option to `true`.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/mysql \
--header 'Content-Type: application/json' \
--data '{
"name": "my-mysql-connection",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"host": "123.4.5.6",
"port": 3306,
"database": "default",
"username": "infisical_role",
"password": "my-password",
"sslEnabled": true,
"sslRejectUnauthorized": true
},
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-mysql-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "mysql",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 3306,
"database": "default",
"username": "infisical_role",
"sslEnabled": true,
"sslRejectUnauthorized": true
}
}
}
```
# Netlify Connection
Source: https://infisical.com/docs/integrations/app-connections/netlify
Learn how to configure a Netlify Connection for Infisical.
Infisical supports the use of [Personal Access Tokens](https://docs.netlify.com/api/get-started/#get-access-tokens) to connect with Netlify.
Netlify requires the token to have **full access** to enable secret management for your sites and services.
## Create a Netlify Personal Access Token
![Netlify User Settings]()
![Applications Tab]()
Provide a name for your token and generate it.
![Token Form]()
Make sure to copy the token now—you won’t be able to access it again.
![Token Generated]()
## Create a Netlify Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **Netlify Connection** from the list of integrations.
![Select Netlify Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* The API Token from the previous step
![Netlify Connection Modal]()
After submitting the form, your **Netlify Connection** will be successfully created and ready to use with your Infisical project.
![Netlify Connection Created]()
To create a Netlify Connection via API, send a request to the [Create Netlify Connection](/docs/api-reference/endpoints/app-connections/netlify/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/netlify \
--header 'Content-Type: application/json' \
--data '{
"name": "my-netlify-connection",
"method": "access-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"accessToken": "[ACCESS TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-netlify-connection",
"description": null,
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2025-07-19T10:15:00.000Z",
"updatedAt": "2025-07-19T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "netlify",
"method": "access-token",
"credentials": {}
}
}
```
# NetScaler Connection
Source: https://infisical.com/docs/integrations/app-connections/netscaler
Learn how to configure a NetScaler Connection for Infisical.
Infisical supports connecting to Citrix NetScaler (ADC) appliances using basic authentication credentials for managing SSL certificates via the NITRO REST API.
## Setup
You will need the following from your NetScaler appliance:
* **Hostname**: The management IP address or FQDN of your NetScaler appliance (e.g., `192.168.1.100` or `netscaler.example.com`).
* **Port**: The HTTPS management port (default: `443`).
* **Username**: A user with administrative access to manage SSL certificates (e.g., `nsroot`).
* **Password**: The password for the user account.
The user account must have permissions to:
* Upload files to `/nsconfig/ssl/`
* Create and manage `sslcertkey` objects
* Bind certificates to SSL virtual servers (if vServer binding is used)
* Save the running configuration
In the Infisical dashboard, navigate to **Organization Settings** > **App Connections** and click **Add Connection**.
![App Connections Tab]()
Select the **NetScaler** option from the list of available connections.
![Select NetScaler Connection]()
Fill in the **Configuration** tab:
* **Hostname**: The management IP or FQDN of the NetScaler appliance.
* **Username**: The NetScaler management username.
* **Password**: The password for the management user.
* **Port** (Optional): HTTPS port for the management interface (default: `443`).
Configure the **SSL** tab:
* **SSL Certificate** (Optional): A CA certificate in PEM format to verify the NetScaler management interface's TLS certificate.
* **Reject Unauthorized**: When enabled, Infisical will only connect if the NetScaler has a valid, trusted TLS certificate. Disable for self-signed certificates or provide a CA certificate.
Optionally select a **Gateway** to route the connection through an Infisical Gateway for private network access.
![NetScaler Connection Form]()
Click **Connect to NetScaler** to validate and save your connection.
Your NetScaler Connection is now available for use with certificate syncs.
![NetScaler Connection Created]()
To create a NetScaler Connection, make an API request to the [Create App Connection](/docs/api-reference/endpoints/app-connections/netscaler/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/netscaler \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-netscaler-connection",
"method": "basic-auth",
"credentials": {
"hostname": "netscaler.example.com",
"port": 443,
"username": "nsroot",
"password": "your-password",
"sslRejectUnauthorized": false
}
}'
```
### Sample response
```json Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-netscaler-connection",
"app": "netscaler",
"method": "basic-auth",
"credentials": {
"hostname": "netscaler.example.com",
"port": 443,
"username": "nsroot",
"sslRejectUnauthorized": false
}
}
}
```
# Northflank Connection
Source: https://infisical.com/docs/integrations/app-connections/northflank
Learn how to configure a Northflank Connection for Infisical.
Infisical supports the use of [API Tokens](https://northflank.com/docs/v1/api/use-the-api) to connect with [Northflank](https://northflank.com).
Infisical recommends creating a specific API role for the app connection and only giving access to projects that will use the integration.
## Create a Northflank API Token
Navigate to your team page and click **Create token**.
![Create API Role]()
Click on **Create API role**.
![Create API Role]()
Select all the projects you want this role to have access to, or leave this unchecked if you want to give access to all projects.
![Create API Role]()
Add the **Projects** -> **Manage** -> **Read** permission.
![Create API Role]()
Add the **Config & Secrets** -> **Secret Groups** -> **List**, **Update** and **Read Values** permissions.
![Create API Role]()
Scroll to the bottom and save the API role.
Click on the **API** -> **Tokens** menu on the left and then click the **Create API token** button.
![Create API Token]()
Give a name to the API token and click the **Use role** button for the new API role you just created.
![Create API Token]()
Click the **View API token** icon to view and copy your token.
![Create API Token]()
## Create a Northflank Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **Northflank Connection** from the list of integrations.
![Select Northflank Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* The API Token from the previous step
![Northflank Connection Modal]()
After submitting the form, your **Northflank Connection** will be successfully created and ready to use with your Infisical project.
![Northflank Connection Created]()
To create a Northflank Connection via API, send a request to the [Create Northflank Connection](/docs/api-reference/endpoints/app-connections/northflank/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/northflank \
--header 'Content-Type: application/json' \
--data '{
"name": "my-northflank-connection",
"method": "api-token",
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"credentials": {
"apiToken": "[API TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-northflank-connection",
"description": null,
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2025-01-23T10:15:00.000Z",
"updatedAt": "2025-01-23T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "northflank",
"method": "api-token",
"credentials": {}
}
}
```
# Nutanix Prism Central Connection
Source: https://infisical.com/docs/integrations/app-connections/nutanix-prism-central
Learn how to configure a Nutanix Prism Central Connection for Infisical.
Infisical supports connecting to Nutanix Prism Central using either Basic Auth credentials or an API Key to manage SSL certificates on your clusters.
## Setup
You will need the following from your Nutanix Prism Central instance:
* **Hostname**: The FQDN or IP address of your Prism Central instance (e.g., `pc.acme.com`).
* **Port**: The API port (default: `9440`).
* **Auth Method**: Choose one of the following:
* **Basic Auth**: A Prism Central user account with the **Cluster Admin** role on the target cluster.
* **API Key**: Create a Service Account with the **Cluster Admin** role on the target cluster and generate a key.
The account or API key must have permission to read cluster information and manage SSL certificates on the target cluster.
Nutanix Prism Central instances on private networks (e.g., `10.x.x.x`, `192.168.x.x`) are blocked by default. For self-hosted Infisical, set the `ALLOW_INTERNAL_IP_CONNECTIONS=true` environment variable, or use an [Infisical Gateway](/docs/documentation/platform/gateways/overview) to reach your Prism Central instance.
In the Infisical dashboard, navigate to **Organization Settings** > **App Connections** and click **Add Connection**.
![App Connections Tab]()
Select the **Nutanix Prism Central** option from the list of available connections.
Fill in the connection form:
* **Name**: A label for this connection (e.g., `prod-prism-central`).
* **Hostname**: The FQDN or IP address of your Prism Central instance.
* **Port** (Optional): API port, default is `9440`.
* **Auth Method**: Select **API Key** or **Basic Auth**:
* *API Key*: Enter your API key.
* *Basic Auth*: Enter your **Username** and **Password**.
Configure the **SSL** tab:
* **SSL Certificate** (Optional): A CA certificate in PEM format to verify the Prism Central instance's TLS certificate.
* **Reject Unauthorized**: When enabled, Infisical will only connect if Prism Central has a valid, trusted TLS certificate. Disable for self-signed certificates or provide a CA certificate.
Optionally select a **Gateway** to route the connection through an [Infisical Gateway](/docs/documentation/platform/gateways/overview) when Prism Central is hosted in an air-gapped or private network.
Click **Connect to Nutanix Prism Central** to validate and save the connection. Infisical will verify connectivity before saving.
Your Nutanix Prism Central Connection is now available for use with certificate syncs.
To create a Nutanix Prism Central Connection, make an API request to the [Create App Connection](/docs/api-reference/endpoints/app-connections/nutanix-prism-central/create) endpoint.
### Sample request (Basic Auth)
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/nutanix-prism-central \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-nutanix-connection",
"method": "basic-auth",
"credentials": {
"hostname": "pc.acme.com",
"port": 9440,
"username": "admin",
"password": "",
"sslRejectUnauthorized": false
}
}'
```
### Sample request (API Key)
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/nutanix-prism-central \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-nutanix-connection",
"method": "api-key",
"credentials": {
"hostname": "pc.acme.com",
"port": 9440,
"apiKey": ""
}
}'
```
### Sample response
```json Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-nutanix-connection",
"app": "nutanix-prism-central",
"method": "api-key",
"createdAt": "2026-05-26T00:00:00.000Z",
"updatedAt": "2026-05-26T00:00:00.000Z"
}
}
```
## What's Next?
Update certificates on your Nutanix clusters automatically.
View all supported app connections.
# OCI Connection
Source: https://infisical.com/docs/integrations/app-connections/oci
Learn how to configure an Oracle Cloud Infrastructure Connection for Infisical.
OCI App Connection is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise license to use it.
Infisical supports the use of [API Signing Key Authentication](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm) to connect with OCI.
## Create OCI User
![Search Domains]()
Select the domain in which you want to create the Infisical user account.
![Select Domain]()
![Select Users]()
![Click Create User]()
The name, email, and username can be anything.
![Create User]()
After you've created a user, you'll be redirected to the user's page. Navigate to 'API keys'.
![Select API Keys]()
Click on 'Add API key' and then download or import the private key. After you've obtained the private key, click 'Add'.
![Add API Key]()
After creating the API key, you'll be shown a modal with relevant information. Save the highlighted values (and the private key) for later steps.
![User Info]()
## Create OCI Group
![Search Domains]()
Select the domain in which you want to create the Infisical user account.
![Select Domain]()
![Select Groups]()
The name and description can be anything. **Ensure that you assign the user created in earlier steps to this group**.
![Create Group]()
After creating the group, take note of its name. It will be used in later steps.
## Create OCI Policy
![Search Policies]()
![Click Create Policy]()
The name and description can be anything. Click 'Show manual editor' and paste in the policy rules relevant to your task:
```
Allow group to manage secret-family in compartment
Allow group to use keys in compartment
Allow group to use vaults in compartment
Allow group to inspect compartments in tenancy
```
* **Group Name:** The name of the group you created in earlier steps.
* **Compartment Name:** The name of the compartment which has your secrets vault.
If you'd like to grant Infisical access to all compartments, replace instances of `compartment ` with `tenancy`.
![Create Policy]()
**You must create this policy on the root compartment**, otherwise some functionality may not work.
## Create OCI Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **OCI Connection** option from the available integrations.
![Select OCI Connection]()
Complete the OCI Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The User OCID from [earlier steps](https://infisical.com/docs/integrations/app-connections/oci#create-oci-user)
* The Tenancy OCID from [earlier steps](https://infisical.com/docs/integrations/app-connections/oci#create-oci-user)
* The Region from [earlier steps](https://infisical.com/docs/integrations/app-connections/oci#create-oci-user)
* The Fingerprint from [earlier steps](https://infisical.com/docs/integrations/app-connections/oci#create-oci-user)
* The Private Key PEM from [earlier steps](https://infisical.com/docs/integrations/app-connections/oci#create-oci-user)
![OCI Connection Modal]()
After clicking Create, your **OCI Connection** is established and ready to use with your Infisical project.
![OCI Connection Created]()
To create an OCI Connection, make an API request to the [Create OCI Connection](/docs/api-reference/endpoints/app-connections/oci/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/oci \
--header 'Content-Type: application/json' \
--data '{
"name": "my-oci-connection",
"method": "access-key",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"userOcid": "ocid1.user.oc1..aaaaaaaagrp35tbkvvad4y2j7sug7xonua7dl2gfp4at2u5i5xj4ghnitg3a",
"tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaotfma465m4zumfe2ua64mj2m5dwmlw2llh4g4dnfttnakiifonta",
"region": "us-ashburn-1",
"fingerprint": "9c:f6:18:23:92:73:f8:e1:85:2c:6a:e3:2c:7d:ec:8f",
"privateKey": "[PRIVATE KEY PEM]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-oci-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "oci",
"method": "access-key",
"credentials": {
"userOcid": "ocid1.user.oc1..aaaaaaaagrp35tbkvvad4y2j7sug7xonua7dl2gfp4at2u5i5xj4ghnitg3a",
"tenancyOcid": "ocid1.tenancy.oc1..aaaaaaaaotfma465m4zumfe2ua64mj2m5dwmlw2llh4g4dnfttnakiifonta",
"region": "us-ashburn-1",
"fingerprint": "9c:f6:18:23:92:73:f8:e1:85:2c:6a:e3:2c:7d:ec:8f"
}
}
}
```
# Octopus Deploy Connection
Source: https://infisical.com/docs/integrations/app-connections/octopus-deploy
Learn how to configure an Octopus Deploy Connection for Infisical.
Infisical supports the use of [API Keys](https://octopus.com/docs/octopus-rest-api/how-to-create-an-api-key) to connect with Octopus Deploy.
## Create Octopus Deploy API Key
Octopus Deploy supports two methods for creating API keys: via a user profile or via a service account.
From your Octopus Deploy dashboard, go to **Configuration** > **Users** and click on the **Create Service Accounts** button.
![Service Accounts]()
Provide:
* Username: A name for the service account
* Display Name: A display name for the service account
Then click **Save**.
![Create Service Account]()
Navigate to **Configuration** > **Teams** and click **Add Team**.
![Add Team]()
Provide:
* New Team Name: A name for the team
* Team Description(optional): A description for the team
* Select the team access type:
* Accessible in the `current` space only
* Accessible in all spaces(system team)
![Create Team]()
Then click **Save**.
After creating the team, you will be redirected to the team details page. Click on the **Add Members** button.
![Add Service Account to Team]()
Select the service account you created in the previous step and click **Add**.
![Add Service Account to Team]()
After adding the service account to the team, Click on the **User Roles** tab and click **Include User Role** button.
![Add User Role to Team]()
Search for the **Project Contributor** role and click on the **Apply** button.
![Apply User Role to Team]()
Click on the **Save** button.
![Save User Role to Team]()
After saving the team settings, we have to create an API key for the service account. Go back to **Configuration** > **Users** and find your service account. Click on the service account to view its details.
Click on the **API Keys** section and click **New API Key**.
![Create Service Account API Key]()
Provide a purpose for the key and set an expiry date, then click **Generate New**.
![Generate API Key]()
Make sure to copy the API key now, you won't be able to access it again.
![Service Account API Key Generated]()
Infisical recommends using a service account for production integrations as they provide better security and are not tied to individual user accounts.
From your Octopus Deploy dashboard, click on your profile in the bottom left corner and select **My profile**.
![Octopus Deploy User Profile]()
In your profile settings, go to the **My API Keys** tab and click **New API Key**.
![API Keys Tab]()
Provide a purpose for the key. Set an expiry date, then click **Generate New**.
![Create API Key]()
Make sure to copy the API key now, you won't be able to access it again.
![API Key Generated]()
## Create an Octopus Deploy Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **Octopus Deploy** Connection from the list of integrations.
![Select Octopus Deploy Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* The Instance URL (e.g., [https://your-instance.octopus.app](https://your-instance.octopus.app))
* The API Key from the previous step
![Octopus Deploy Connection Modal]()
After submitting the form, your **Octopus Deploy Connection** will be successfully created and ready to use with your Infisical project.
![Octopus Deploy Connection Created]()
To create an Octopus Deploy Connection via API, send a request to the [Create Octopus Deploy Connection](/docs/api-reference/endpoints/app-connections/octopus-deploy/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/octopus-deploy \
--header 'Content-Type: application/json' \
--data '{
"name": "my-octopus-deploy-connection",
"method": "api-key",
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"credentials": {
"instanceUrl": "https://your-instance.octopus.app",
"apiKey": "[API KEY]"
}
}'
```
### Sample response
```json Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-octopus-deploy-connection",
"description": null,
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2025-10-13T10:15:00.000Z",
"updatedAt": "2025-10-13T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "octopus-deploy",
"method": "api-key",
"credentials": {
"instanceUrl": "https://your-instance.octopus.app",
}
}
}
```
# Okta Connection
Source: https://infisical.com/docs/integrations/app-connections/okta
Learn how to configure an Okta Connection for Infisical.
Infisical supports the use of [API Tokens](https://developer.okta.com/docs/guides/create-an-api-token/main/) to connect with Okta.
## Create Okta API Token
From the Okta admin dashboard, navigate to **Security > API > Tokens** and click **Create token**.
![Create API Token]()
Enter the token name and select **Any IP** for the second dropdown, then click **Create token**.
![Provide Info]()
Copy the token from the modal for later steps.
![Copy Token]()
## Create Okta Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **Add Connection** button and select **Okta** from the list of available connections.
Complete the Okta Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* Your Okta instance URL
* The API Token from earlier steps
![Connection Modal]()
After clicking Create, your **Okta Connection** is established and ready to use with your Infisical project.
![Connection Created]()
To create a Okta Connection, make an API request to the [Create Okta Connection](/docs/api-reference/endpoints/app-connections/okta/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/okta \
--header 'Content-Type: application/json' \
--data '{
"name": "my-okta-connection",
"method": "api-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"instanceUrl": "https://example.okta.com",
"apiToken": ""
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-okta-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "okta",
"method": "api-token",
"credentials": {
"instanceUrl": "https://example.okta.com"
}
}
}
```
# Ona Connection
Source: https://infisical.com/docs/integrations/app-connections/ona
Learn how to configure an Ona Connection for Infisical.
Infisical supports connecting to [Ona](https://www.gitpod.io/) (Gitpod's cloud development environment platform) using a Personal Access Token (PAT).
## Create an Ona Personal Access Token
In the lower-left corner of Ona, select your name, then click the gear icon to open user settings.
![Open Account setting]()
![PAT tab]()
Click the **New Token** button and add a description for the token (eg, "infisical integration"). The token must have Read & Write access so that Infisical can apply changes in Ona.
Personal access tokens have an expiration date, so you will need to manually rotate them before they expire to avoid integration downtime. Consider setting a calendar reminder for this task.
![Open PAT section]()
![New token modal]()
Make sure to save the token, as it won't be shown again.
![Copy Token]()
## Create an Ona Connection in Infisical
In your Infisical dashboard, open the **Integrations** tab for the desired project and select **App Connections**. Click **+ Add Connection**.
![App Connections Tab]()
Choose **Ona Connection** from the list of integrations.
![Select Ona Connection]()
Complete the form by providing:
* A descriptive **Name** for the connection.
* An optional **Description**.
* The **Personal Access Token** you generated in Ona.
![Ona Connection Modal]()
After submitting the form, your **Ona Connection** will be created.
![Ona Connection Created]()
To create an Ona Connection via API, send a request to the [Create Ona Connection](/docs/api-reference/endpoints/app-connections/ona/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/ona \
--header 'Content-Type: application/json' \
--data '{
"name": "my-ona-connection",
"method": "personal-access-token",
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"credentials": {
"personalAccessToken": "[PERSONAL ACCESS TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-ona-connection",
"description": null,
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2025-01-23T10:15:00.000Z",
"updatedAt": "2025-01-23T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "ona",
"method": "personal-access-token",
"credentials": {}
}
}
```
# OpenAI Connection
Source: https://infisical.com/docs/integrations/app-connections/openai
Learn how to configure an OpenAI connection for Infisical.
Infisical supports connecting to OpenAI using an **Admin API Key**. This connection is used to create and rotate OpenAI project service accounts via [Secret Rotation](/docs/documentation/platform/secret-rotation/openai-service-account).
## Prerequisites
You need an OpenAI **Admin API key** created by an **Organization Owner**. Admin API keys are organization-scoped and can manage organization resources such as users, projects, and API keys. A regular project API key (for example, one starting with `sk-`) does not have these permissions and will fail validation.
## Create an OpenAI Admin API Key
In the [OpenAI dashboard](https://platform.openai.com/), click your account in the bottom-left corner to open the menu.
![OpenAI Account Menu]()
Select **Organization settings** from the menu.
![OpenAI Organization Settings]()
In the organization settings, open the **Admin keys** tab.
![OpenAI Admin Keys Tab]()
Click **Create new Admin key** on the top right corner.
![Create New Admin Key]()
Give the key a descriptive name (e.g. `infisical-key`), set the permissions as needed, and click **Create admin key**.
![Name and Create Admin Key]()
Copy the generated Admin API key and store it securely. It will only be shown once.
![Copy Admin API Key]()
Create a dedicated Admin API key for Infisical rather than reusing an existing one. This makes it easy to rotate or revoke access independently.
## Create OpenAI Connection in Infisical
In your Infisical dashboard, go to **Integrations** → **App Connections** tab in your project.
![App Connections Tab]()
Click **Add Connection** and choose **OpenAI** from the list of available connections.
![Select OpenAI Connection]()
Complete the form with:
* A **name** for the connection
* An optional **description**
* Your **Admin API Key** (from the steps above)
![OpenAI Connection Form]()
After clicking **Connect to OpenAI**, Infisical validates the key against the OpenAI API. Your **OpenAI Connection** is then ready to use for [OpenAI Service Account Secret Rotation](/docs/documentation/platform/secret-rotation/openai-service-account).
![OpenAI Connection Created]()
Create an OpenAI connection via the [Create OpenAI Connection](/docs/api-reference/endpoints/app-connections/openai/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/openai \
--header 'Content-Type: application/json' \
--data '{
"name": "my-openai-connection",
"method": "api-key",
"credentials": {
"apiKey": ""
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-openai-connection",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"app": "openai",
"method": "api-key",
"credentials": {}
}
}
```
# OpenRouter Connection
Source: https://infisical.com/docs/integrations/app-connections/openrouter
Learn how to configure an OpenRouter (LLM router) connection for Infisical.
[OpenRouter](https://openrouter.ai/) is a unified LLM router that gives you access to hundreds of large language models through a single API. Infisical supports connecting to OpenRouter using an **API Key** (Provisioning API key). This connection is used to manage and rotate OpenRouter API keys via [Secret Rotation](/docs/documentation/platform/secret-rotation/openrouter-api-key).
## Prerequisites
You need a **Provisioning API key** from OpenRouter. Provisioning keys are used only for key management (create, list, delete keys)—they cannot be used for model completion requests.
## Create an OpenRouter Provisioning API Key
In [OpenRouter Settings](https://openrouter.ai/settings/provisioning-keys), go to **Provisioning API Keys** and click **Create New Key**.
![OpenRouter Provisioning Keys]()
Complete the key creation flow and copy the generated Provisioning API key. Store it securely—you will use it when creating the Infisical connection.
![OpenRouter Key Created]()
For more details on Provisioning API keys and key management, see [OpenRouter's documentation](https://openrouter.ai/docs/guides/overview/auth/provisioning-api-keys).
## Create OpenRouter Connection in Infisical
In your Infisical dashboard, go to **Organization Settings** → **App Connections** (or the **Integrations** → **App Connections** tab in your project).
![App Connections Tab]()
Click **Add Connection** and choose **OpenRouter** from the list of available connections.
![Select OpenRouter Connection]()
Complete the form with:
* A **name** for the connection (e.g. `openrouter-prod`)
* An optional **description**
* Your **OpenRouter Provisioning API Key** (from the steps above)
![OpenRouter Connection Form]()
After clicking **Create**, Infisical validates the key against OpenRouter's API. Your **OpenRouter Connection** is then ready to use for [OpenRouter API Key Secret Rotation](/docs/documentation/platform/secret-rotation/openrouter-api-key).
![OpenRouter Connection Created]()
Create an OpenRouter connection via the [Create OpenRouter Connection](/docs/api-reference/endpoints/app-connections/openrouter/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/open-router \
--header 'Content-Type: application/json' \
--data '{
"name": "my-openrouter-connection",
"method": "api-key",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiKey": ""
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-openrouter-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "...",
"app": "open-router",
"method": "api-key",
"credentials": {}
}
}
```
# OracleDB Connection
Source: https://infisical.com/docs/integrations/app-connections/oracledb
Learn how to configure a Oracle Database Connection for Infisical.
OracleDB App Connection is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise license to use it.
Infisical supports connecting to OracleDB using a database user.
## Configure an Oracle Database User for Infisical
Infisical recommends creating a designated user in your Oracle Database for your connection.
```SQL theme={"dark"}
-- create user
CREATE USER infisical IDENTIFIED BY "my-password";
-- grant create session privileges
GRANT CREATE SESSION TO infisical;
```
Username must either be ALL UPPERCASE or not be surrounded by "quotes". Values not surrounded by quotes get automatically transformed to uppercase by Oracle Database.
Depending on how you intend to use your OracleDB connection, you'll need to grant one or more of the following permissions.
To learn more about the Oracle Database permission system, please visit their [documentation](https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-privilege-and-role-authorization.html).
For Secret Rotations, your Infisical user will require the ability to alter other users' passwords:
```SQL theme={"dark"}
-- enable permissions to alter login credentials
GRANT ALTER USER TO infisical;
```
You'll need the following information to create your Oracle Database connection:
* `host` - The hostname or IP address of your Oracle Database server
* `port` - The port number your Oracle Database server is listening on (default: 1521)
* `database` - The Oracle Service Name or SID (System Identifier) for the database you are connecting to. For example: `ORCL`, `FREEPDB1`, `XEPDB1`
* `username` - The user name of the login created in the steps above
* `password` - The user password of the login created in the steps above
* `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
This configuration can only be done on self-hosted or dedicated instances of Infisical.
Infisical includes Oracle Instant Client by default, enabling mTLS wallet-based connections without modifying the Docker image. You only need to mount your Oracle Wallet and configure the environment.
When `TNS_ADMIN` is set and points to a valid wallet directory, **all Oracle Database connections** in your Infisical instance will use the wallet for authentication.
**Gateway Limitation**: Wallet-based connections do not support [Infisical Gateway](/docs/documentation/platform/gateways/overview). The connection details (host, port, protocol) are read directly from the `tnsnames.ora` file in the wallet, bypassing the gateway routing.
### Prerequisites
Your Oracle Wallet folder should contain the following files:
* `cwallet.sso` - Auto-login wallet (SSO wallet)
* `tnsnames.ora` - Connection aliases for your Oracle Database
* `sqlnet.ora` - Network configuration
### Configuration Steps
Ensure your `sqlnet.ora` file points to the correct wallet directory. Update the `DIRECTORY` path to match where you'll mount the wallet in the container:
```ini theme={"dark"}
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = /app/wallet)
)
)
SQLNET.AUTHENTICATION_SERVICES = (TCPS)
SSL_CLIENT_AUTHENTICATION = TRUE
```
Mount your wallet directory and set the `TNS_ADMIN` environment variable to point to it.
**Environment Variable (`.env` file):**
```ini theme={"dark"}
TNS_ADMIN=/app/wallet
```
**Volume Mount Examples:**
```bash theme={"dark"}
docker run -d \
-v /path/to/your/wallet:/app/wallet:ro \
--env-file .env \
# ... other Infisical configuration ...
infisical/infisical:latest
```
```yaml theme={"dark"}
services:
infisical:
image: infisical/infisical:latest
env_file:
- .env
volumes:
- /path/to/your/wallet:/app/wallet:ro
# ... other Infisical configuration ...
```
You'll need the following information to create the connection in Infisical:
* `host` - The hostname or IP address of your Oracle Database server (required field, but not used for wallet connections).
* `port` - The port number your Oracle Database server is listening on (required field, but not used for wallet connections).
* `database` - The TNS alias for your Oracle Database from your `tnsnames.ora` file.
* `username` - The user name of the login created in the steps above.
* `password` - The user password of the login created in the steps above.
When a wallet is detected (via the `TNS_ADMIN` environment variable), the connection uses the TNS alias from the `database` field to look up full connection details (host, port, protocol) from your `tnsnames.ora` file.
The host and port fields in the connection form are required but ignored for wallet connections. Any SSL settings in the connection form are also ignored - the wallet's certificates are used instead.
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
## Create Connection in Infisical
1. Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
2. Select the **OracleDB Connection** option.
![Select OracleDB Connection]()
3. Select the **Username & Password** method option and provide the details obtained from the previous section and press **Connect to OracleDB**.
Optionally, if you'd like Infisical to manage the credentials of this connection, you can enable the Platform Managed Credentials option.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database user.
![Create OracleDB Connection]()
4. Your **OracleDB Connection** is now available for use.
![Assume User OracleDB Connection]()
To create an Oracle Database Connection, make an API request to the [Create OracleDB Connection](/docs/api-reference/endpoints/app-connections/oracledb/create) API endpoint.
Optionally, if you'd like Infisical to manage the credentials of this connection, you can set the `isPlatformManagedCredentials` option to `true`.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database user.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/oracledb \
--header 'Content-Type: application/json' \
--data '{
"name": "my-oracledb-connection",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"host": "123.4.5.6",
"port": 1521,
"database": "FREEPDB1",
"username": "infisical",
"password": "my-password",
"sslEnabled": true,
"sslRejectUnauthorized": true
},
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-oracledb-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "oracledb",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 1521,
"database": "FREEPDB1",
"username": "infisical",
"sslEnabled": true,
"sslRejectUnauthorized": true
}
}
}
```
# Overview
Source: https://infisical.com/docs/integrations/app-connections/overview
Learn how to manage and configure third-party app connections with Infisical.
App Connections enable you to integrate your Infisical projects with third-party services in a secure and versatile way.
App connections can also be created and managed independently in projects now.
## Concept
App Connections can be used to establish connections with third-party applications
that can be used across multiple features. Example use cases include syncing secrets, rotating credentials, scanning repositories for secret leaks, and more.
```mermaid theme={"dark"}
%%{init: {'flowchart': {'curve': 'linear'} } }%%
graph TD
A[AWS]
B[AWS Connection]
C[Project 1 Secret Sync]
D[Project 2 Secret Sync]
E[Project 3 Generate Dynamic Secret]
B --> A
C --> B
D --> B
E --> B
classDef default fill:#ffffff,stroke:#666,stroke-width:2px,rx:10px,color:black
classDef aws fill:#FFF2B2,stroke:#E6C34A,stroke-width:2px,color:black,rx:15px
classDef project fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
classDef connection fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
class A aws
class B connection
class C,D,E project
```
## Workflow
App Connections require initial setup in both your third-party application and Infisical. Follow these steps to establish a secure connection:
For step-by-step guides specific to each application, refer to the App Connections section in the sidebar.
1. Create Access Entity: If necessary, create an entity such as a service account or role within the third-party application you want to connect to. Be sure
to limit the access of this entity to the minimal permission set required to perform the operations you need. For example:
* For secret syncing: Read/write permissions to specific secret stores
* For dynamic secrets: Permissions to create temporary credentials
Whenever possible, Infisical encourages creating a designated service account for your App Connection to limit the scope of permissions based on your use-case.
2. Generate Authentication Credentials: Obtain the required credentials from your third-party application. These can vary between applications and might be:
* an API key or access token
* A client ID and secret pair
* other credentials, etc.
3. Create App Connection: Configure the connection in Infisical using your generated credentials through either the UI or API.
Some App Connections can only be created via the UI such as connections using OAuth.
4. Utilize the Connection: Use your App Connection for various features across Infisical such as our Secrets Sync by selecting it via the dropdown menu
in the UI or by passing the associated `connectionId` when generating resources via the API.
## Platform Managed Credentials
Some App Connections support the ability to have their credentials managed by Infisical. By enabling this option,
Infisical will modify the credentials to prevent external use of the configured access entity.
# OVH Cloud Connection
Source: https://infisical.com/docs/integrations/app-connections/ovh
Learn how to configure an OVH Cloud Connection for Infisical.
Infisical authenticates to [OVHcloud Key Management Service (OKMS)](https://www.ovhcloud.com/en/identity-security-operations/secret-manager/) using mutual TLS (mTLS) with a PEM-encoded client certificate pair issued by OVH for your OKMS instance.
## Generate an OVH OKMS Access Certificate
Log in to the [OVHcloud Control Panel](https://www.ovh.com/manager/) and navigate to **Identity, Security & Operations** > **Key Management Service**.
![OKMS Dashboard]()
Click on **Order an OKMS Domain**
![OKMS Dashboard]()
Select the OKMS region that you want to use. You will also need to confirm by accepting the terms
![OKMS Region]()
![OKMS Activate Region]()
On your summary, the desired domain by clicking on it.
![OKMS Summary]()
You will need to get the following values to create a connection.
* **OKMS ID** — the UUID-style identifier shown on the OKMS summary page.
* **REST API endpoint** — the base URL of the OKMS instance (e.g. `https://ca-east-bhs.okms.ovh.net`). This is the **OKMS Domain** value in Infisical.
![OKMS Details]()
Open the **Access certificate** tab
![Access Certificate Tab]()
Click on Generate an access certificate.
![Generate Access Certificate]()
Define the validity of the certificate and download the two PEM files offered:
* `*_privatekey.pem` — the private key.
* `*_certificate.pem` — the public certificate.
![Create Access Certificate]()
Infisical does **not** support the PKCS12 (`.p12`) format. If OVH offers a PKCS12 download or asks you to convert the PEM files with `openssl pkcs12`, ignore those options and keep the PEM files as-is. Node.js's TLS layer (used by Infisical's HTTP client) cannot parse PKCS12 bundles and returns `Unsupported PKCS12 PFX data.` when one is provided.
## Create an OVH Cloud Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **OVH Cloud Connection** from the list of integrations.
![Select OVH Cloud Connection]()
Complete the form by providing:
* A descriptive **Name** for the connection.
* An optional **Description**.
* **Private Key (PEM)** — paste the full contents of `*_privatekey.pem`, including the `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----` markers.
* **Certificate (PEM)** — paste the full contents of `*_certificate.pem`, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` markers.
* **OKMS Domain** — the OKMS base URL (e.g. `https://ca-east-bhs.okms.ovh.net`). Do not include the `/api` suffix; Infisical appends it automatically.
* **OKMS ID** — the OKMS instance identifier from the OVHcloud Control Panel.
![OVH Cloud Connection Form]()
Infisical validates the credentials by calling `GET {OKMS Domain}/api/{OKMS ID}/v1/servicekey` with mTLS. A successful `200` response means the PEM pair is trusted by your OKMS instance.
After submitting the form, your **OVH Cloud Connection** is created and ready to use with Secret Syncs.
![OVH Cloud Connection Created]()
To create an OVH Cloud Connection via API, send a request to the [Create OVH Cloud Connection](/docs/api-reference/endpoints/app-connections/ovh/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/ovh \
--header 'Content-Type: application/json' \
--data '{
"name": "my-ovh-connection",
"method": "certificate",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
"certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n",
"okmsDomain": "https://ca-east-bhs.okms.ovh.net",
"okmsId": "00000000-0000-0000-0000-000000000000"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-ovh-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2026-04-23T10:15:00.000Z",
"updatedAt": "2026-04-23T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "ovh",
"method": "certificate",
"credentials": {}
}
}
```
# PostgreSQL Connection
Source: https://infisical.com/docs/integrations/app-connections/postgres
Learn how to configure a PostgreSQL Connection for Infisical.
Infisical supports connecting to PostgreSQL using a database role.
## Configure a PostgreSQL Role for Infisical
Infisical recommends creating a designated role in your PostgreSQL database for your connection.
```SQL theme={"dark"}
-- create user role
CREATE ROLE infisical_role WITH LOGIN PASSWORD 'my-password';
-- grant login access to the specified database
GRANT CONNECT ON DATABASE my_database TO infisical_role;
```
Depending on how you intend to use your PostgreSQL connection, you'll need to grant one or more of the following permissions.
To learn more about PostgreSQL's permission system, please visit their [documentation](https://www.postgresql.org/docs/current/sql-grant.html).
For Secret Rotations, your Infisical user will require the ability to alter other users' passwords:
```SQL theme={"dark"}
-- enable permissions to alter login credentials
ALTER ROLE infisical_role WITH CREATEROLE;
```
In some configurations, the role performing the rotation must be explicitly granted access to manage each user. To do this, grant the user's role to the rotation role with:
```SQL theme={"dark"}
-- grant each user role to admin user for password rotation
GRANT TO WITH ADMIN OPTION;
```
Replace `` with each specific username whose credentials will be rotated, and `` with the role that will perform the rotation.
You'll need the following information to create your PostgreSQL connection:
* `host` - The hostname or IP address of your PostgreSQL server
* `port` - The port number your PostgreSQL server is listening on (default: 5432)
* `database` - The name of the specific database you want to connect to
* `username` - The role name of the login created in the steps above
* `password` - The role password of the login created in the steps above
* `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
## Create Connection in Infisical
1. Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
2. Select the **PostgreSQL Connection** option.
![Select PostgreSQL Connection]()
3. Select the **Username & Password** method option and provide the details obtained from the previous section and press **Connect to PostgreSQL**.
Optionally, if you'd like Infisical to manage the credentials of this connection, you can enable the Platform Managed Credentials option.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
![Create PostgreSQL Connection]()
4. Your **PostgreSQL Connection** is now available for use.
![Assume Role PostgreSQL Connection]()
To create a PostgreSQL Connection, make an API request to the [Create PostgreSQL
Connection](/docs/api-reference/endpoints/app-connections/postgres/create) API endpoint.
Optionally, if you'd like Infisical to manage the credentials of this connection, you can set the `isPlatformManagedCredentials` option to `true`.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/postgres \
--header 'Content-Type: application/json' \
--data '{
"name": "my-pg-connection",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"host": "123.4.5.6",
"port": 5432,
"database": "default",
"username": "infisical_role",
"password": "my-password",
"sslEnabled": true,
"sslRejectUnauthorized": true
},
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-pg-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "postgres",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 5432,
"database": "default",
"username": "infisical_role",
"sslEnabled": true,
"sslRejectUnauthorized": true
}
}
}
```
# Qovery Connection
Source: https://infisical.com/docs/integrations/app-connections/qovery
Learn how to configure a Qovery Connection for Infisical.
Infisical supports the use of [Project Access Tokens](https://www.qovery.com/docs/api-reference/introduction) to connect with Qovery.
## Create Qovery Access Token
In the Qovery console, select the **Settings** tab for your organization.
![Qovery Organization Settings]()
In the settings sidebar, select **API token**.
![Qovery API Token Section]()
![Add New API Token]()
Give the token a name and assign it a role that can read organizations, projects, and environments and manage variables at the scope you intend to sync to, then click **Create**. After creating the token, a modal containing your project access token will appear. Save this token for later steps.
![Create Qovery API Token]()
## Create Qovery Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **Qovery Connection** option from the available integrations.
![Select Qovery Connection]()
Complete the Qovery Connection form by entering:
* A descriptive **Name** for the connection
* An optional **Description** for future reference
* The **Method**, set to **Personal Access Token**
* The **Project Access Token** from earlier steps
Then click **Connect to Qovery**.
![Qovery Connection Modal]()
After clicking Connect to Qovery, your **Qovery Connection** is established and ready to use with your Infisical project.
![Qovery App Connection]()
To create a Qovery Connection, make an API request to the [Create Qovery Connection](/docs/api-reference/endpoints/app-connections/qovery/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/qovery \
--header 'Content-Type: application/json' \
--data '{
"name": "my-qovery-connection",
"method": "access-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"accessToken": "[PROJECT ACCESS TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-qovery-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "qovery",
"method": "access-token",
"credentials": {}
}
}
```
# Railway Connection
Source: https://infisical.com/docs/integrations/app-connections/railway
Learn how to configure a Railway Connection for Infisical.
Infisical supports the use of [API Tokens](https://docs.railway.com/guides/public-api#creating-a-token) to connect with Railway.
## Create a Railway API Token
A team token provides access to all resources within a team. It cannot be used to access personal resources in Railway.
![Dashboard Page]()
![Account Settings Page]()
Make sure to provide a descriptive name and select the correct team.
![Enter Name and Select Team]()
![Create Token]()
After clicking 'Create', your access token will be displayed. Save it securely for later use.
![Copy Token Modal]()
If no team is selected, the token will be associated with your personal Railway account and will have access to all your individual and team resources.
![Dashboard Page]()
![Account Settings Page]()
Provide a descriptive name and ensure no team is selected. This will create an account-level token.
![Enter Name]()
![Create Token]()
After clicking 'Create', your access token will be shown. Save it for future use.
![Copy Token Modal]()
Project tokens are limited to a specific environment within a project and can only be used to authenticate requests to that environment.
![Dashboard Page]()
![Project Settings Page]()
![Project Token Settings Page]()
Provide a descriptive name and select the appropriate environment for the token.
![Enter Name and Select environment]()
![Create Token]()
After clicking 'Create', the access token will be displayed. Be sure to save it for later use.
![Copy Token Modal]()
## Create a Railway Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **Railway Connection** from the list of integrations.
![Select Railway Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* The type of token you created earlier
* The token value from the previous step
![Railway Connection Modal]()
After submitting the form, your **Railway Connection** will be successfully created and ready to use with your Infisical project.
![Railway Connection Created]()
To create a Railway Connection via API, send a request to the [Create Railway Connection](/docs/api-reference/endpoints/app-connections/railway/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/railway \
--header 'Content-Type: application/json' \
--data '{
"name": "my-railway-connection",
"method": "team-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiToken": "[TEAM TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-railway-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "railway",
"method": "team-token",
"credentials": {}
}
}
```
# Redis Connection
Source: https://infisical.com/docs/integrations/app-connections/redis
Learn how to configure a Redis Connection for Infisical.
Infisical supports the use of Username & Password authentication to connect with Redis databases
## Configure a Redis user for Infisical
Infisical recommends creating a designated user in your Redis database for your connection.
```bash theme={"dark"}
ACL SETUSER user_manager on >[ENTER-YOUR-USER-PASSWORD]
```
Depending on how you intend to use your Redis connection, you'll need to grant one or more of the following permissions.
To learn more about Redis's permission system, please visit their [documentation](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/).
For Secret Rotations, your Infisical user will require the ability to set and delete users:
```bash theme={"dark"}
ACL SETUSER user_manager +acl|setuser +acl|deluser ~*
```
## Create Redis Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **Redis Connection** option from the available integrations.
![Select Redis Connection]()
Complete the Redis Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The Redis host URL for your database
* The Redis port for your Redis database
* The Redis username for your Redis database
* The Redis password for your Redis database
You can optionally configure SSL/TLS for your Redis connection in the **SSL** section.
![Redis Connection Modal]()
After clicking Create, your **Redis Connection** is established and ready to use with your Infisical project.
![Redis Connection Created]()
To create a Redis Connection, make an API request to the [Create Redis Connection](/docs/api-reference/endpoints/app-connections/redis/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/redis \
--header 'Content-Type: application/json' \
--data '{
"name": "my-redis-connection",
"method": "username-and-password",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"host": "[REDIS HOST]",
"port": 6379,
"username": "[REDIS USERNAME]",
"password": "[REDIS PASSWORD]",
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-redis-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "redis",
"method": "username-and-password",
credentials: {
"host": "",
"port": 6379,
"username": "",
"sslEnabled": true,
"sslRejectUnauthorized": false,
"sslCertificate": ""
}
}
}
```
# Render Connection
Source: https://infisical.com/docs/integrations/app-connections/render
Learn how to configure a Render Connection for Infisical.
Infisical supports connecting to Render using API keys for secure access to your Render services.
## Configure API Key for Infisical
Navigate to your Render dashboard and click on **Account Settings** in the
top right corner. ![Account
Settings]()
In the Account Settings page, scroll down to the **API Keys** section and
click **Create API Key**. ![Create API
Key]()
Enter a descriptive name for your API key (e.g., "production")
and click **Create API Key**. ![Name API
Key]()
After creation, you'll be shown your API key. Make sure to copy and securely
store this key as it will not be shown again.
## Setup Render Connection in Infisical
Navigate to the **Integrations** tab in the desired project, then select **App Connections**. ![App Connections
Tab]()
Select the **Render Connection** option from the connection options modal.
![Select Render
Connection]()
Enter your Render API key in the provided field and click **Connect to
Render** to establish the connection. ![Connect to
Render]()
Your **Render Connection** is now available for use in your Infisical
projects. ![Render Connection
Created]()
# Rundeck Connection
Source: https://infisical.com/docs/integrations/app-connections/rundeck
Learn how to configure a Rundeck Connection for Infisical.
Infisical supports connecting to Rundeck using an **API Token**.
## Generate a Rundeck API Token
Log in to your Rundeck instance and click the user icon in the top-right corner.
![Rundeck profile menu]()
Select **Profile** from the dropdown.
![Select Profile]()
In the **User API Tokens** section, click the **+** button.
![User API Tokens]()
In the **Generate New Token** dialog, enter:
* **Name**: a label to identify the token (e.g., `INFISICAL_TOKEN`)
* **User**: the username associated with the token
* **Roles**: comma-separated roles/groups, or leave blank to use all of your current roles
* **Expiration in**: an optional lifetime; set to `0` for the maximum allowed duration
Click **Generate New Token**.
![Generate New Token]()
The API token inherits the access of the user and roles it is generated with. Grant only the
permissions required to read projects and manage Key Storage for your target projects.
Copy the generated token and store it securely, as you won't be able to view it again after
closing the dialog. Click **Close** when done.
![Save Your new Token]()
If you configure an expiration for your API token, you must manually rotate to a new token
before it expires to prevent service interruption.
## Setup Rundeck Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project,
select **App Connections**, and click **+ Add Connection**. Search for and select the
**Rundeck** option.
![Select Rundeck Connection]()
Complete the connection form by entering:
* A descriptive **Name** for the connection (must be slug-friendly)
* An optional **Description** for future reference
* The **Method** (**API Token**)
* The **Rundeck Instance URL** (e.g., `https://rundeck.example.com`)
* The **Rundeck API Token** you generated above
Click **Connect to Rundeck**.
![Rundeck Connection Form]()
Your **Rundeck Connection** is established and ready to use with your Infisical project.
![Rundeck Connection Created]()
To create a Rundeck Connection, make an API request to the [Create Rundeck
Connection](/docs/api-reference/endpoints/app-connections/rundeck/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/rundeck \
--header 'Content-Type: application/json' \
--data '{
"name": "my-rundeck-connection",
"method": "api-token",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"credentials": {
"instanceUrl": "https://rundeck.example.com",
"apiToken": "..."
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-rundeck-connection",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "rundeck",
"method": "api-token",
"credentials": {
"instanceUrl": "https://rundeck.example.com"
}
}
}
```
# Salesforce Connection
Source: https://infisical.com/docs/integrations/app-connections/salesforce
Learn how to configure a Salesforce Connection for Infisical.
Infisical supports the OAuth 2.0 [Client Credentials](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm\&type=5) flow to connect with your Salesforce org.
## Configure a Connected App in Salesforce
In the top-right corner, click the gear icon.
![Gear Icon]()
Click the **Setup** option.
![Open Setup]()
In Salesforce Setup, search for **External Client App Manager** and select it from the results.
![Search External Client App Manager]()
Click **New External Client App**.
![Create External Client App]()
Provide a name, API name, and contact email.
![Basic Information]()
Under **API (Enable OAuth Settings)**:
* Check **Enable OAuth**.
* Provide a callback URL.
The callback URL is only used by Salesforce's OAuth Web Server Flow. Since this External Client App is used solely to rotate secrets via the Client Credentials Flow, the callback URL is never invoked — any valid URL (e.g. `https://localhost`) works.
* Add the OAuth scopes your integration requires. For secret rotation, you must select **Manage user data via APIs (api)**.
* Check **Enable Client Credentials Flow** and **Enable Token Exchange Flow** (along with the sub-option **Require secret for Token Exchange Flow**).
![OAuth Scopes and Flow Enablement]()
Under **Security**, enable **Require secret for Web Server Flow** and **Require secret for Refresh Token Flow**.
Save the Connected App by clicking **Create**. It may take a few minutes for the new app to become available.
![OAuth Security Settings]()
Go back to the **External Client App Manager** page and select the External Client App you just created. To do this, search again for **External Client App Manager**.
![External created app]()
Click the app you just created, select the **Policies** tab, and click **Edit**.
![Policies Tab]()
Under the **OAuth Policies** section, check **Enable Client Credentials Flow** and provide a username under **Run As (Username)** to specify which user the flow runs as.
![Policies]()
Back on the **Settings** tab, go to the **OAuth Settings** section and click **Consumer Key and Secret** to open a new page where the values are displayed.
![Consumer Key and Secret Button]()
Copy both the **Consumer Key** and **Consumer Secret** for later.
![Consumer Details]()
Search again for **External Client Apps** and click the **Settings** sub-option. Under **External Client App Settings**, enable **Allow access to External Client App consumer secrets via REST API**.
![Allow Access to Consumer Secrets]()
In Salesforce Setup, search for **My Domain**.
![Search My Domain]()
Copy the **Current My Domain URL** (e.g. `my-org.my.salesforce.com`). This is your instance URL.
![My Domain URL]()
## Setup Salesforce Connection in Infisical
1. Navigate to **App Connections** in your organization or project.
2. Select the **Salesforce Connection** option.
![Select Salesforce Connection]()
3. Enter your **Instance URL**, **Consumer Key**, and **Consumer Secret** from the previous section, then click **Connect to Salesforce**.
![Create Salesforce Connection]()
4. Your **Salesforce Connection** is now available for use.
![Salesforce Connection Created]()
To create a Salesforce Connection, make an API request to the [Create Salesforce
Connection](/docs/api-reference/endpoints/app-connections/salesforce/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/salesforce \
--header 'Content-Type: application/json' \
--data '{
"name": "my-salesforce-connection",
"method": "client-credentials",
"credentials": {
"instanceUrl": "my-org.my.salesforce.com",
"consumerKey": "...",
"consumerSecret": "..."
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-salesforce-connection",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2026-05-04T05:31:56Z",
"updatedAt": "2026-05-04T05:31:56Z",
"app": "salesforce",
"method": "client-credentials",
"credentials": {
"instanceUrl": "my-org.my.salesforce.com"
}
}
}
```
# SMB
Source: https://infisical.com/docs/integrations/app-connections/smb
Learn how to configure an SMB Connection for Infisical.
The SMB Connection allows Infisical to connect to Windows servers using the SMB (Server Message Block) protocol for remote management operations such as password rotation.
## Prerequisites
You will need the following information to establish an SMB connection:
* **Host** - The hostname or IP address of the Windows server where the local accounts to be managed reside. This must be a member server or standalone machine, not a Domain Controller.
* **Port** - The SMB port (default is 445)
* **Username** - A Windows administrator account with permissions to manage local accounts on the target machine
* **Password** - The password for the administrator account
* **Domain** (optional) - The Windows domain name if using domain credentials to authenticate. When provided, Infisical authenticates as a domain user (e.g., `MYDOMAIN\Administrator`) to manage local accounts on the target machine. This allows domain administrators to rotate local account passwords on domain-joined member servers.
### Windows Server Requirements
* **SMB3 Support** - This connection uses SMB3 with encryption enabled for secure communication with Windows servers.
* **Firewall Configuration** - The server must be accessible from Infisical or from the Infisical Gateway if using it.
Run the following PowerShell command as Administrator on the Windows server to allow inbound SMB connections:
```powershell theme={"dark"}
New-NetFirewallRule -DisplayName "Allow SMB Inbound" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow
```
To verify the rule was created:
```powershell theme={"dark"}
Get-NetFirewallRule -DisplayName "Allow SMB Inbound"
```
## Setup SMB Connection in Infisical
Navigate to the **App Connections** tab in your Organization Settings.
![App Connections Tab]()
Click the **+ Add Connection** button and select **SMB** from the available options.
![Select SMB Connection]()
Complete the SMB Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The Windows server host (hostname or IP address)
* The SMB port (default is 445)
* The domain name (optional, for domain-joined servers)
* The administrator username
* The administrator password
![SMB Connection Modal]()
After clicking Create, your **SMB Connection** is established and ready to use with your Infisical project.
![SMB Connection Created]()
To create an SMB Connection, make an API request to the [Create SMB
Connection](/docs/api-reference/endpoints/app-connections/smb/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/smb \
--header 'Content-Type: application/json' \
--data '{
"name": "my-windows-connection",
"method": "credentials",
"credentials": {
"host": "192.168.1.100",
"port": 445,
"username": "Administrator",
"password": "your-admin-password",
"domain": "MYDOMAIN"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-windows-connection",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "smb",
"method": "credentials",
"credentials": {
"host": "192.168.1.100",
"port": 445,
"username": "Administrator",
"domain": "MYDOMAIN"
}
}
}
```
# Snowflake Connection
Source: https://infisical.com/docs/integrations/app-connections/snowflake
Learn how to configure a Snowflake Connection for Infisical.
Infisical supports connecting to Snowflake using a **Username** and a **Programmatic Access Token (PAT)**. PATs are scoped, revocable credentials that authenticate as a Snowflake user without exposing the user's password.
## Prerequisites
* A [Snowflake account](https://app.snowflake.com/) with permission to create Programmatic Access Tokens.
* The **account identifier** for your Snowflake instance, which combines your organization name and account name. You can find it in your Snowflake login URL (`https://app.snowflake.com/orgName/accountName/#/account/users`) or under **Account Details** in Snowsight.
Create a dedicated Snowflake user (or role) for Infisical rather than reusing a personal account. This keeps the connection's blast radius small and makes it easy to rotate or revoke access independently.
## Create a Snowflake Programmatic Access Token
In [Snowsight](https://app.snowflake.com/), open the side bar menu and select **Users & roles** under **Governance & Security**.
![Snowflake User Profile]()
Click **Create user** in the top-right corner.
![Generate Programmatic Access Token]()
Programmatic Access Tokens require an attached network policy that defines the IPs allowed to authenticate as this user. To create one, hover over **Projects**, click on **Workspaces**, and create a network policy. The snippet below creates one that allows access from any IP.
![Go into workspace]()
```SQL theme={"dark"}
CREATE NETWORK POLICY INFISICAL_SYNC_POLICY
ALLOWED_IP_LIST = ('0.0.0.0/0')
COMMENT = 'Allow access from any IP';
ALTER USER INFISICAL set NETWORK_POLICY = 'INFISICAL_SYNC_POLICY';
```
Be careful with the IPs you allow in your network policy. Using `0.0.0.0/0` allows access from **any IP address**, which can be dangerous in production. Prefer restricting the list to only the IP ranges that should be allowed to authenticate (for example, your corporate NAT(s) and/or Infisical's outbound IPs if you have them).
Provide a **Username** and assign a role. Then grant the role the privileges required for how you intend to use the connection.
![Configure User]()
To run the grant statements below, select the **Projects** tab and click on **Workspaces** to open the query editor.
![Go into workspace]()
The role must have permission to create and manage secrets in the target database. The following snippet grants the minimum privileges required for operations on specific tables and schemas.
```SQL theme={"dark"}
-- Grant INFISICAL user access to SECRET_SYNC_TEST
CREATE ROLE IF NOT EXISTS INFISICAL_ROLE;
GRANT ROLE INFISICAL_ROLE TO USER INFISICAL; -- Change INFISICAL to be your user
GRANT ALL PRIVILEGES ON DATABASE SECRET_SYNC_TEST TO ROLE INFISICAL_ROLE;
GRANT ALL PRIVILEGES ON SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE;
GRANT OWNERSHIP ON ALL SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS; -- Transfers ownership
GRANT OWNERSHIP ON FUTURE SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS; -- Transfers ownership
```
If you select a custom role, note that **secret ownership is enforced per object**. Existing secrets in the target schema remain owned by their creator unless you transfer ownership. Infisical must use a role that **owns every secret it manages** (required for `CREATE OR REPLACE SECRET` and `DROP SECRET`). If the schema already has secrets, run the `GRANT OWNERSHIP ON ALL SECRETS ...` statement; always keep the `GRANT OWNERSHIP ON FUTURE SECRETS ...` statement.
For [Snowflake User Key Pair rotation](/docs/documentation/platform/secret-rotation/snowflake-user-key-pair), the connection's role must be able to alter the target user whose key pair will be rotated. Grant a role that can manage the user and assign it to your connection user:
```SQL theme={"dark"}
-- create a role Infisical will use to manage the target user
CREATE ROLE IF NOT EXISTS INFISICAL_ROTATION_ROLE;
-- allow the role to alter the target user's RSA public key
GRANT OWNERSHIP ON USER MY_TARGET_USER TO ROLE INFISICAL_ROTATION_ROLE;
-- (optional) allow the role to create the target user if it does not exist yet
GRANT CREATE USER ON ACCOUNT TO ROLE INFISICAL_ROTATION_ROLE;
-- assign the role to the user backing your Snowflake Connection
GRANT ROLE INFISICAL_ROTATION_ROLE TO USER MY_CONNECTION_USER;
```
If the target user already exists, the connection's role only needs privileges to **alter** it (e.g. `OWNERSHIP` on the user). If the user does **not** exist yet, the role additionally requires the `CREATE USER` privilege on the account.
To learn more about managing users and privileges in Snowflake, see their [access control documentation](https://docs.snowflake.com/en/user-guide/security-access-control-overview).
Hover over **Governance & Security** and click on **Users & roles**. Select the user you want to use in Infisical. Open the **Programmatic access tokens** tab and click **Generate new token**. Give the token a descriptive name (e.g. `infisical`) and configure its expiration and role restrictions according to your security policy.
![Generate Programmatic Access Token]()
![Fill up PAT info]()
Copy the generated token. Snowflake only displays it once — store it somewhere secure for the next step.
![Copy Programmatic Access Token]()
Copy the **Account identifier**. The fastest way is to read it from your Snowsight URL (`https://app.snowflake.com/orgName/accountName/#/account/users`), where the identifier is `orgName-accountName`.
Alternatively, click your username in the bottom-left corner, open **Account details**, and copy the **Account** value from the **Config File** tab.
![Account details button]()
![Account details]()
![Account info]()
## Create Snowflake Connection in Infisical
In your Infisical dashboard, go to **Organization Settings** → **App Connections**.
![App Connections Tab]()
Click **Add Connection** and choose **Snowflake** from the list of available connections.
![Select Snowflake Connection]()
Complete the form with:
* A **name** for the connection (e.g. `snowflake-prod`)
* An optional **description**
* The Snowflake **Account** identifier (e.g. `orgName-accountName`)
* The Snowflake **Username** (The name of the user that was created)
* The **Programmatic Access Token** generated in the previous section
![Snowflake Connection Form]()
After clicking **Create**, Infisical validates the credentials by opening a connection to your Snowflake account. Once validated, your **Snowflake Connection** is ready to use.
![Snowflake Connection Created]()
Create a Snowflake connection via the API.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/snowflake \
--header 'Content-Type: application/json' \
--data '{
"name": "my-snowflake-connection",
"method": "username-and-token",
"credentials": {
"account": "xy12345.us-east-1",
"username": "",
"password": ""
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-snowflake-connection",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"app": "snowflake",
"method": "username-and-token",
"credentials": {
"account": "xy12345.us-east-1",
"username": ""
}
}
}
```
# SSH
Source: https://infisical.com/docs/integrations/app-connections/ssh
Learn how to configure an SSH Connection for Infisical.
Infisical supports both SSH key authentication and username-password authentication.
## Prerequisites
You will need the following information to establish an SSH connection:
* **Username** - The username with the required permissions to connect (e.g., `root`)
* **Host** - The hostname or IP address of the machine
* **Password/Private Key** - The password or SSH private key for the user
## Setup SSH Connection in Infisical
Navigate to the **App Connections** tab in your Organization Settings.
![App Connections Tab]()
Click the **+ Add Connection** button and select **SSH Connection** from the available options.
![Select SSH Connection]()
Complete the SSH Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The SSH host (hostname or IP address)
* The SSH port (default is 22)
* The username for your machine
* The SSH password for the user
![SSH Connection Modal]()
Complete the SSH Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The SSH host (hostname or IP address)
* The SSH port (default is 22)
* The username for your machine
* The SSH private key
* An optional passphrase if the private key is protected
![SSH Connection Modal]()
After clicking Create, your **SSH Connection** is established and ready to use with your Infisical project.
![SSH Connection Created]()
To create an SSH Connection, make an API request to the [Create SSH
Connection](/docs/api-reference/endpoints/app-connections/ssh/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/ssh \
--header 'Content-Type: application/json' \
--data '{
"name": "my-ssh-connection",
"method": "ssh-key",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"host": "[ssh host]",
"port": 22,
"privateKey": "[SSH Private Key]",
"username": "root"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-ssh-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "ssh",
"method": "ssh-key",
"credentials": {
"host": "[ssh host]",
"port": 22,
"privateKey": "[SSH Private Key]",
"username": "root"
}
}
}
```
# Supabase Connection
Source: https://infisical.com/docs/integrations/app-connections/supabase
Learn how to configure a Supabase Connection for Infisical.
Infisical supports the use of [Personal Access Tokens](https://supabase.com/dashboard/account/tokens) to connect with Supabase.
## Create a Supabase Personal Access Token
![Account Preferences]()
![Settings Page]()
![Access Tokens Page]()
Provide a descriptive name for the token.
![Enter Name]()
![Create Token]()
## Create a Supabase Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **Supabase Connection** from the list of integrations.
![Select Supabase Connection]()
Complete the form by providing:
* A descriptive name for the connection
* An optional description
* Supabase instance URL (e.g., `https://your-domain.com` or `https://api.supabase.com`)
* The Access Token value from the previous step
![Supabase Connection Modal]()
After submitting the form, your **Supabase Connection** will be successfully created and ready to use with your Infisical project.
![Supabase Connection Created]()
To create a Supabase Connection via API, send a request to the [Create Supabase Connection](/docs/api-reference/endpoints/app-connections/supabase/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/supabase \
--header 'Content-Type: application/json' \
--data '{
"name": "my-supabase-connection",
"method": "access-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"accessToken": "[Access Token]",
"instanceUrl": "https://api.supabase.com"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-supabase-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "supabase",
"method": "access-token",
"credentials": {
"instanceUrl": "https://api.supabase.com"
}
}
}
```
# TeamCity Connection
Source: https://infisical.com/docs/integrations/app-connections/teamcity
Learn how to configure a TeamCity Connection for Infisical.
Infisical supports connecting to TeamCity using Access Tokens.
## Setup TeamCity Connection in Infisical
Navigate to the TeamCity **Profile** page by clicking on your profile icon in the bottom-left corner.
![TeamCity Main Page]()
Select the **Access Tokens** tab from the left sidebar navigation menu.
![TeamCity Token Page]()
Click the **Create access token** button and provide a name for your token (e.g., "Infisical Integration"). You may set an expiration date or leave it blank for no expiry.
The permission scope can either be **Same as current user** or **Limit per project**.
If you're choosing **Limit per project**, make sure you select the relevant project and enable the permissions relevant to your use case:
* View build configuration settings
* Edit project
![TeamCity Token Popup]()
Setting your permission scope to **Same as current user** will allow your integration to access multiple projects as long as the current user has read and write access to them.
If you configure an expiry date for your access token, you must manually rotate to a new token before the expiration date to prevent service interruption.
After creation, a modal with the Access Token will be displayed. Copy this token immediately and store it securely, as you won't be able to view it again after closing this dialog.
![TeamCity Token Copy Popup]()
You should now see your newly created token in the list of access tokens.
![TeamCity Token Created]()
1. Navigate to App Connections
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
2. Add Connection
Click the **+ Add Connection** button and select the **TeamCity Connection** option from the available integrations.
![Select TeamCity Connection]()
3. Fill the TeamCity Connection Modal
Complete the TeamCity Connection form by entering:
* A descriptive name for the connection
* The Access Token you generated in steps 3-4
* The URL of your TeamCity instance
* An optional description for future reference
![TeamCity Connection Modal]()
4. Connection Created
After clicking Create, your **TeamCity Connection** is established and ready to use with your Infisical project.
![TeamCity Connection Created]()
To create a TeamCity Connection, make an API request to the [Create TeamCity
Connection](/docs/api-reference/endpoints/app-connections/teamcity/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/teamcity \
--header 'Content-Type: application/json' \
--data '{
"name": "my-teamcity-connection",
"method": "access-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"accessToken": "...",
"instanceUrl": "https://yourcompany.teamcity.com"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-teamcity-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "teamcity",
"method": "access-token",
"credentials": {
"instanceUrl": "https://yourcompany.teamcity.com"
}
}
}
```
# Terraform Cloud Connection
Source: https://infisical.com/docs/integrations/app-connections/terraform-cloud
Learn how to configure a Terraform Cloud Connection for Infisical.
Infisical supports connecting to Terraform Cloud using a service user.
## Setup Terraform Cloud Connection in Infisical
Navigate to the Terraform Cloud **Account Settings** tab.
![Terraform Cloud Account Settings]()
Move to the **Tokens** tab.
![Terraform Cloud Tokens Tab]()
Create the API token to be used by Infisical.
If you configure an expiry date for your API token you will need to manually rotate to a new token prior to expiration to avoid integration downtime.
![Terraform Cloud Create API Token]()
The API token will be displayed after creating it. Save the token in a secure location for later use in the following steps.
![Terraform Cloud Copy API Token]()
1. Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
2. Select the **Terraform Cloud Connection** option from the connection options modal.
![Select Terraform Cloud Connection]()
3. Fill out the Terraform Cloud Connection modal, here you will need to provide the API Token generated in the previous step.
![Terraform Cloud Connection Modal]()
4. Your **Terraform Cloud Connection** is now available for use.
![Terraform Cloud Connection Created]()
To create an Terraform Cloud Connection, make an API request to the [Create Terraform Cloud
Connection](/docs/api-reference/endpoints/app-connections/terraform-cloud/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/terraform-cloud \
--header 'Content-Type: application/json' \
--data '{
"name": "my-terraform-cloud-connection",
"method": "api-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiToken": "...",
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-terraform-cloud-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 123,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "terraform-cloud",
"method": "api-token",
"credentials": {
"apiToken": "..."
}
}
}
```
# Travis CI Connection
Source: https://infisical.com/docs/integrations/app-connections/travis-ci
Learn how to configure a Travis CI Connection for Infisical.
Infisical supports connecting to [Travis CI](https://www.travis-ci.com/) using a personal API Token.
The API Token must belong to a user with sufficient permissions to manage
environment variables on the repositories you plan to sync with Infisical.
## Create a Travis CI API Token
Navigate to [https://app.travis-ci.com](https://app.travis-ci.com) and click your profile avatar in the top-right corner, then select **Settings**.
In the **Settings** tab, locate the **API authentication** section. Click **Copy Token** to reveal and copy your personal API token.
![Copy Travis CI API Token]()
Treat this token like a password — it grants access to every repository you
have permission to administer. Store it somewhere safe; Infisical will
encrypt it at rest once the connection is created.
## Create a Travis CI Connection in Infisical
In your Infisical dashboard, open the **Integrations** tab in the target project and select **App Connections**.
![App Connections Tab]()
Click **+ Add Connection** and choose **Travis CI Connection** from the list.
![Select Travis CI Connection]()
Complete the form by providing:
* A descriptive **Name** for the connection
* An optional **Description**
* The **API Token** you copied from Travis CI
![Travis CI Connection Form]()
After submitting, your **Travis CI Connection** is ready to be used by Secret Syncs and other Infisical features.
To create a Travis CI Connection via API, send a request to the [Create Travis CI Connection](/docs/api-reference/endpoints/app-connections/travis-ci/create) endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/travis-ci \
--header 'Content-Type: application/json' \
--data '{
"name": "my-travis-ci-connection",
"method": "api-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiToken": "[API TOKEN]"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-travis-ci-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2026-04-17T19:46:34.831Z",
"updatedAt": "2026-04-17T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "example-credentials-hash",
"app": "travis-ci",
"method": "api-token",
"credentials": {}
}
}
```
# Trigger.dev Connection
Source: https://infisical.com/docs/integrations/app-connections/trigger-dev
Learn how to configure a Trigger.dev Connection for Infisical.
Infisical supports the use of [Personal Access Tokens](https://trigger.dev/docs/management/overview#personal-access-token-pat) to connect with Trigger.dev.
## Create Trigger.dev Personal Access Token
In the [Trigger.dev dashboard](https://cloud.trigger.dev), click your account avatar in the top-left corner to open the account menu, then select **Account**.
![Open Account Menu]()
Select **Personal Access Tokens** from the menu.
![Personal Access Tokens]()
Click **Create new token**.
![Create New Token]()
Give the token a descriptive name, then click **Create token**.
![Create Token Modal]()
After creating the token, a value beginning with `tr_pat_` will appear. Copy and save this token for later steps, as you will not be able to view it again.
![Copy Token]()
## Create Trigger.dev Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **Trigger.dev Connection** option from the available integrations.
Complete the Trigger.dev Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The Personal Access Token from earlier steps
* An optional Instance URL if you are connecting to a self-hosted Trigger.dev deployment. Leave this blank to use Trigger.dev Cloud (`https://api.trigger.dev`).
After clicking Create, your **Trigger.dev Connection** is established and ready to use with your Infisical project.
To create a Trigger.dev Connection, make an API request to the [Create Trigger.dev Connection](/docs/api-reference/endpoints/app-connections/trigger-dev/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/trigger-dev \
--header 'Content-Type: application/json' \
--data '{
"name": "my-trigger-dev-connection",
"method": "api-key",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiKey": "tr_pat_...",
"instanceUrl": "https://api.trigger.dev"
}
}'
```
The `instanceUrl` field is optional. Omit it to connect to Trigger.dev Cloud (`https://api.trigger.dev`), or provide it to connect to a self-hosted Trigger.dev deployment.
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-trigger-dev-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "trigger-dev",
"method": "api-key",
"credentials": {
"instanceUrl": "https://api.trigger.dev"
}
}
}
```
# Venafi Connection
Source: https://infisical.com/docs/integrations/app-connections/venafi
Learn how to configure a Venafi TLS Protect Cloud Connection for Infisical.
Connect Infisical to Venafi TLS Protect Cloud to use Venafi as an external CA for signing internal intermediate certificate authorities.
## Prerequisites
* A [Venafi TLS Protect Cloud](https://venafi.com/) account
* An API key generated from your Venafi TLS Protect Cloud dashboard
## Connection Setup
Navigate to the **App Connections** tab on the **Organization Settings** page.
![App Connections Tab]()
Select the **Venafi TLS Protect Cloud** option from the connection options modal.
Configure the following fields:
* **Name**: A friendly name for this Venafi connection (e.g., "Production Venafi")
* **Method**: The authentication method. Currently only **API Key** is supported.
* **Region**: The region of your Venafi TLS Protect Cloud instance. Supported regions:
* US (United States)
* EU (Europe)
* AU (Australia)
* UK (United Kingdom)
* SG (Singapore)
* CA (Canada)
* **API Key**: The API key from your Venafi TLS Protect Cloud dashboard
Click **Connect to Venafi** to validate your credentials and create the connection.
Infisical validates the API key by connecting to the Venafi TLS Protect Cloud API during connection creation.
If the validation fails, check that your API key is correct and that you have selected the right region.
Your **Venafi Connection** is now available for use with internal intermediate CAs in your Infisical projects.
# Venafi TPP Connection
Source: https://infisical.com/docs/integrations/app-connections/venafi-tpp
Learn how to configure a Venafi Trust Protection Platform (TPP) Connection for Infisical.
Connect Infisical to a self-hosted Venafi Trust Protection Platform (TPP) instance to use it as an external CA for certificate issuance and management.
## Prerequisites
* A self-hosted [Venafi Trust Protection Platform](https://venafi.com/) instance (on-premises or private cloud)
* An API Integration registered in your TPP instance with OAuth enabled
* A TPP user account with `certificate:manage,discover,revoke` and `configuration` scope privileges
* Network connectivity from Infisical to the TPP server (or an Infisical Gateway for airgapped environments)
To register an API Integration in Venafi TPP, navigate to **API** > **API Integrations** in the TPP web console
and create a new integration with a Client ID. This Client ID is required when setting up the connection in Infisical.
## Connection Setup
Navigate to the **App Connections** tab on the **Organization Settings** page.
![App Connections Tab]()
Select the **Venafi TPP** option from the connection options modal.
![Select Venafi TPP Connection]()
Configure the following fields:
* **Name**: A friendly name for this connection (e.g., "Production TPP")
* **Method**: The authentication method. Currently only **OAuth** is supported.
* **Gateway** *(optional)*: Select an Infisical Gateway if your TPP instance is in an airgapped network without direct internet access.
* **TPP URL**: The HTTPS URL of your Venafi TPP instance (e.g., `https://tpp.example.com`). Must use HTTPS.
* **Client ID**: The OAuth Client ID from your TPP API Integration.
* **Username**: The TPP user account. Supports formats: `DOMAIN\username`, `username@domain.com`, or local usernames.
* **Password**: The password for the TPP user account.
Click **Connect to Venafi TPP** to validate your credentials and create the connection.
![Venafi TPP Connection Form]()
Infisical validates the credentials by authenticating with the TPP OAuth endpoint during connection creation.
If validation fails, verify that:
* The TPP URL is correct and reachable
* The Client ID matches an API Integration registered in TPP
* The username and password are correct
* The API Integration has the required scopes enabled
Your **Venafi TPP Connection** is now available for use as an external CA in your Infisical certificate management projects.
![Venafi TPP Connection Created]()
## Gateway Support
For Venafi TPP instances running in airgapped or isolated networks, you can route the connection through an [Infisical Gateway](/docs/documentation/platform/gateways/overview). Select the appropriate gateway when creating the connection to enable Infisical to reach your TPP server through a secure tunnel.
# Vercel Connection
Source: https://infisical.com/docs/integrations/app-connections/vercel
Learn how to configure a Vercel Connection for Infisical.
Infisical supports connecting to Vercel using API Tokens.
## Setup Vercel Connection in Infisical
Navigate to the Vercel **Account Settings** page by clicking on your profile icon in the top-right corner.
![Vercel API Tokens Tab]()
Select the **API Tokens** tab from the left sidebar navigation menu.
![Vercel API Tokens Tab]()
Click the **Create** button and provide a name for your token (e.g., "Infisical Integration").
Choose appropriate scope permissions based on your requirements.
If you configure an expiry date for your API token, you will need to manually rotate to a new token prior to expiration to avoid integration downtime. Consider setting a calendar reminder for this task.
![Vercel Create API Token]()
After creation, a modal with the API token will be displayed. Copy this token immediately and store it securely, as you won't be able to view it again after closing this dialog.
![Vercel Copy API Token]()
You should now see your newly created token in the list of API tokens on the Vercel dashboard.
![Vercel Connection Created]()
1. Navigate to App Connections
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
2. Add Connection
Click the **+ Add Connection** button and select the **Vercel Connection** option from the available integrations.
![Select Vercel Connection]()
3. Fill the Vercel Connection Modal
Complete the Vercel Connection form by entering:
* A descriptive name for the connection
* The API Token you generated in steps 3-4
* An optional description for future reference
![Vercel Connection Modal]()
4. Connection Created
After clicking Create, your **Vercel Connection** is established and ready to use with your Infisical project.
![Vercel Connection Created]()
To create a Vercel Connection, make an API request to the [Create Vercel
Connection](/docs/api-reference/endpoints/app-connections/vercel/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/vercel \
--header 'Content-Type: application/json' \
--data '{
"name": "my-vercel-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"method": "api-token",
"credentials": {
"apiToken": "...",
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-vercel-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 123,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2025-04-01T05:31:56Z",
"updatedAt": "2025-04-01T05:31:56Z",
"app": "vercel",
"method": "api-token",
"credentials": {}
}
}
```
# Windmill Connection
Source: https://infisical.com/docs/integrations/app-connections/windmill
Learn how to configure a Windmill Connection for Infisical.
Infisical supports connecting to Windmill using Access Tokens.
## Get a Windmill Access Token
Ensure the user generating the access token has the required role and permissions based on your use-case:
The user generating the access token should be at least a `Developer` in the configured workspace and have `write` permissions for the workspace path secrets will be synced to.
In Windmill, click on your user in the sidebar and select **Account Settings**.
![Windmill Account Settings]()
In the **Tokens** section on the drawer, click **Create token**.
![Windmill Create Token]()
Give your token a name and click **New token**.
If you configure an expiry date for your access token, you must manually rotate to a new token before the expiration date to prevent service interruption.
![Windmill New Token]()
Copy your new access token and save it for the steps below.
![Windmill Copy Token]()
## Setup Windmill Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **Windmill Connection** option.
![Select Windmill Connection]()
Configure your Windmill Connection using the access token generated in the steps above. Then click **Connect to Windmill**.
![Windmill Configure Connection]()
* **Name**: The name of the connection to be created. Must be slug-friendly.
* **Description**: An optional description to provide details about this connection.
* **Instance URL**: The URL of your Windmill instance. If you are not self-hosting Windmill you can leave this field blank.
* **Access Token**: The access token generated in the steps above.
Your Windmill Connection is now available for use.
![Windmill Connection Created]()
To create a Windmill Connection, make an API request to the [Create Windmill
Connection](/docs/api-reference/endpoints/app-connections/windmill/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/windmill \
--header 'Content-Type: application/json' \
--data '{
"name": "my-windmill-connection",
"method": "access-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"token": "...",
"instanceUrl": "https://app.windmill.dev"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-windmill-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"version": 123,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2025-04-01T05:31:56Z",
"updatedAt": "2025-04-01T05:31:56Z",
"app": "windmill",
"method": "access-token",
"credentials": {
"instanceUrl": "https://app.windmill.dev"
}
}
}
```
# Windows (WinRM) Connection
Source: https://infisical.com/docs/integrations/app-connections/winrm
Learn how to configure a Windows (WinRM) Connection for Infisical.
Infisical supports connecting to Windows hosts over WinRM to deliver certificates. The connection always routes through an [Infisical Gateway](/docs/documentation/platform/gateways/overview) inside your network, which reaches the host and runs the WinRM session on Infisical's behalf. By default it uses HTTP with NTLM message encryption, which keeps the certificate and key confidential without a server certificate. HTTPS is also supported.
## Setup
You will need the following for the target Windows host:
* **Host**: The DNS name (FQDN) or IP address of the Windows host.
* **Port**: The WinRM port. `5985` for HTTP with NTLM message encryption, `5986` for HTTPS.
* **Username**: A Windows login, either `DOMAIN\user` or `user@domain.com`.
* **Password**: The account password.
The account must be able to open a WinRM session and write to the destination directory used by the certificate sync. HTTP with NTLM message encryption works against the default WinRM listener with no extra setup. HTTPS additionally requires a WinRM HTTPS listener on the host.
In the Infisical dashboard, navigate to **Organization Settings** > **App Connections** and click **Add Connection**.
Select the **Windows (WinRM)** option from the list of available connections.
Fill in the connection form:
* **Gateway**: The Gateway that can reach the Windows host. This is required.
* **Host** and **Port**: The Windows host and WinRM port (5985 for HTTP, 5986 for HTTPS).
* **Username** and **Password**: The Windows account credentials.
* **Enable SSL**: Off (default) uses HTTP with NTLM message encryption, which needs no server certificate. On uses HTTPS.
* **SSL Certificate** (HTTPS only): Optional CA certificate (PEM). Leave empty to verify the listener against the system trust store, or paste the listener's certificate to verify a self-signed WinRM HTTPS listener.
* **Reject Unauthorized** (HTTPS only): When on (default), Infisical only connects if the listener presents a valid, trusted certificate.
Click **Connect to Windows (WinRM)** to validate and save your connection.
Your Windows (WinRM) Connection is now available for use with the [Windows Server Certificate Sync](/docs/documentation/platform/pki/applications/certificate-syncs/windows-server).
To create a Windows (WinRM) Connection via API, send a request to the [Create WinRM Connection](/docs/api-reference/endpoints/app-connections/winrm/create) endpoint.
The connection must be attached to a Gateway that can reach the Windows host, so `gatewayId` is required.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/winrm \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-winrm-connection",
"method": "username-password",
"gatewayId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"credentials": {
"host": "win01.corp.example.com",
"port": 5985,
"username": "DOMAIN\\svc-infisical",
"password": "[PASSWORD]",
"sslEnabled": false,
"sslRejectUnauthorized": true
}
}'
```
## Transport
By default (SSL disabled) the connection uses HTTP with NTLM message encryption on port 5985, which keeps the certificate and key confidential without a server certificate. This is the zero-configuration posture most Windows hosts already ship with.
Enable SSL to use HTTPS on port 5986. For a self-signed HTTPS listener, paste its certificate as the SSL certificate so it can be authenticated. For a host on an untrusted network, prefer HTTPS.
## FAQ
The Gateway runs the WinRM session on Infisical's behalf, so a Gateway with access to the Windows host is always required.
# Zabbix Connection
Source: https://infisical.com/docs/integrations/app-connections/zabbix
Learn how to configure a Zabbix Connection for Infisical.
Infisical supports the use of [API Tokens](https://www.zabbix.com/documentation/current/en/manual/web_interface/frontend_sections/users/api_tokens) to connect with Zabbix.
## Create Zabbix API Token
![Dashboard Page]()
![Click Create Token]()
Ensure that you give this token access to the correct app, then click 'Create Token'.
![Create Token Page]()
After clicking 'Create Token', a modal containing your access token will appear. Save this token for later steps.
![Copy Token Modal]()
## Create Zabbix Connection in Infisical
In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
![App Connections Tab]()
Click the **+ Add Connection** button and select the **Zabbix Connection** option from the available integrations.
![Select Zabbix Connection]()
Complete the Zabbix Connection form by entering:
* A descriptive name for the connection
* An optional description for future reference
* The Zabbix URL for your instance
* The API Token from earlier steps
![Zabbix Connection Modal]()
After clicking Create, your **Zabbix Connection** is established and ready to use with your Infisical project.
![Zabbix Connection Created]()
To create a Zabbix Connection, make an API request to the [Create Zabbix Connection](/docs/api-reference/endpoints/app-connections/zabbix/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/zabbix \
--header 'Content-Type: application/json' \
--data '{
"name": "my-zabbix-connection",
"method": "api-token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"apiToken": "[API TOKEN]",
"instanceUrl": "https://zabbix.example.com"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-zabbix-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "zabbix",
"method": "api-token",
"credentials": {
"instanceUrl": "https://zabbix.example.com"
}
}
}
```
# Gradle
Source: https://infisical.com/docs/integrations/build-tools/gradle
How to use Infisical to inject environment variables with Gradle
# Using Infisical with Gradle
By integrating [Infisical CLI](../../cli/overview) with Gradle, you can configure your builds and scripts to different environments, CI/CD pipelines, and more without explicitly setting variables in the command line.
This documentation provides an overview of how to use Infisical with [Gradle](https://gradle.org/).
## Basic Usage
To run a Gradle task with Infisical, you can use the `run` command. The basic structure is:
```
infisical run -- [Your command here]
```
For example, to run the `generateFile` task in Gradle:
```groovy build.gradle theme={"dark"}
task generateFile {
doLast {
String content = System.getenv('ENV_NAME_FROM_INFISICAL') ?: 'Default Content'
file('output.txt').text = content
println "Generated output.txt with content: $content"
}
}
```
```
infisical run -- gradle generateFile
```
With this command, Infisical will automatically inject the environment variables associated with the current Infisical project into the Gradle process.
Your Gradle script can then access these variables using `System.getenv('VARIABLE_NAME')`.
## More Examples
### 1. Building a Project with a Specific Profile
Assuming you have different build profiles (e.g., 'development', 'production'), you can use Infisical to switch between them:
```
infisical run -- gradle build
```
Inside your `build.gradle`, you might have:
```groovy build.gradle theme={"dark"}
if (System.getenv('PROFILE') == 'production') {
// production-specific configurations
}
```
### 2. Running Tests with Different Database Configurations
If you want to run tests against different database configurations:
```
infisical run -- gradle test
```
Your test configuration in `build.gradle` can then adjust the database URL accordingly:
```groovy build.gradle theme={"dark"}
test {
systemProperty 'db.url', System.getenv('DB_URL')
}
```
### 3. Generating Artifacts with Versioning
For automated CI/CD pipelines, you might want to inject a build number or version:
```
infisical run -- gradle assemble
```
And in `build.gradle`:
```groovy build.gradle theme={"dark"}
version = System.getenv('BUILD_NUMBER') ?: '1.0.0-SNAPSHOT'
```
## Advantages of Using Infisical with Gradle
1. **Flexibility**: Easily adapt your Gradle builds to different environments without modifying the build scripts or setting environment variables manually.
2. **Reproducibility**: Ensure consistent builds by leveraging the environment variables from the related Infisical project.
3. **Security**: Protect sensitive information by using Infisical's secrets management without exposing them in scripts or logs.
# AWS Amplify
Source: https://infisical.com/docs/integrations/cicd/aws-amplify
Learn how to sync secrets from Infisical to AWS Amplify.
Prerequisites:
* Infisical Cloud account
* Add the secrets you wish to sync to Amplify to [Infisical Cloud](https://app.infisical.com)
There are many approaches to sync secrets stored within Infisical to AWS Amplify. This guide describes two such approaches below.
## Access Infisical secrets at Amplify build time
This approach enables you to fetch secrets from Infisical during Amplify build time.
Create a machine identity and connect it to your Infisical project. You can read more about how to use machine identities [here](/docs/documentation/platform/identities/machine-identities). The machine identity will allow you to authenticate and fetch secrets from Infisical.
![aws amplify env console]()
1. In the Amplify console, choose App Settings, and then select Environment variables.
2. In the Environment variables section, select Manage variables.
3. Under the first Variable enter `INFISICAL_MACHINE_IDENTITY_CLIENT_ID`, and for the value, enter the client ID of the machine identity you created in the previous step.
4. Under the second Variable enter `INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET`, and for the value, enter the client secret of the machine identity you created in the previous step.
5. Click save.
In the prebuild phase, add the command in AWS Amplify to install the Infisical CLI.
```yaml theme={"dark"}
build:
phases:
preBuild:
commands:
- sudo curl -1sLf 'https://artifacts-cli.infisical.com/setup.rpm.sh' | sudo -E bash
- sudo yum -y install infisical
```
You can now pull secrets from Infisical using the CLI and save them as a `.env` file. To do this, modify the build commands.
```yaml theme={"dark"}
build:
phases:
build:
commands:
- INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=${INFISICAL_MACHINE_IDENTITY_CLIENT_ID} --client-secret=${INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET} --silent --plain)
- infisical export --format=dotenv > .env
-
```
Go to your project settings in the Infisical dashboard to generate a [service token](/docs/documentation/platform/token). This service token will allow you to authenticate and fetch secrets from Infisical. Once you have created a service token with the required permissions, you’ll need to provide the token to the CLI installed in your Docker container.
![aws amplify env console]()
1. In the Amplify console, choose App Settings, and then select Environment variables.
2. In the Environment variables section, select Manage variables.
3. Under Variable, enter the key **INFISICAL\_TOKEN**. For the value, enter the generated service token from the previous step.
4. Click save.
In the prebuild phase, add the command in AWS Amplify to install the Infisical CLI.
```yaml theme={"dark"}
build:
phases:
preBuild:
commands:
- sudo curl -1sLf 'https://artifacts-cli.infisical.com/setup.rpm.sh' | sudo -E bash
- sudo yum -y install infisical
```
You can now pull secrets from Infisical using the CLI and save them as a `.env` file. To do this, modify the build commands.
```yaml theme={"dark"}
build:
phases:
build:
commands:
- INFISICAL_TOKEN=${INFISICAL_TOKEN}
- infisical export --format=dotenv > .env
-
```
## Sync Secrets Using AWS SSM Parameter Store
Another approach to use secrets from Infisical in AWS Amplify is to utilize AWS Parameter Store.
At high level, you begin by using Infisical's AWS SSM Parameter Store integration to sync secrets from Infisical to AWS SSM Parameter Store. You then instruct AWS Amplify to consume those secrets from AWS SSM Parameter Store as [environment secrets](https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html#environment-secrets).
Follow the [Infisical AWS SSM Parameter Store Secret Syncs Guide](../secret-syncs/aws-parameter-store) to set up the integration. Pause once you reach the step where it asks you to select the path you would like to sync.
![amplify app id]()
1. Open your AWS Amplify App console.
2. Go to **Actions >> View App Settings**
3. The App ID will be the last part of the App ARN field after the slash.
You need to set the path in the format `/amplify/[amplify_app_id]/[your-amplify-environment-name]` as the path option in AWS SSM Parameter Infisical Integration.
Accessing an environment secret during a build is similar to accessing
environment variables, except that environment secrets are stored in
`process.env.secrets` as a JSON string.
# Bitbucket
Source: https://infisical.com/docs/integrations/cicd/bitbucket
How to sync secrets from Infisical to Bitbucket
Infisical lets you sync secrets to Bitbucket at the repository-level and deployment environment-level.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
Use our [Bitbucket Secret Syncs](../secret-syncs/bitbucket)
Configure a [Machine Identity](https://infisical.com/docs/documentation/platform/identities/universal-auth) for your project and give it permissions to read secrets from your desired Infisical projects and environments.
Create Bitbucket variables (can be either workspace, repository, or deployment-level) to store Machine Identity Client ID and Client Secret.
![integrations bitbucket]()
Edit your Bitbucket pipeline YAML file to include the use of the Infisical CLI to fetch and inject secrets into any script or command within the pipeline.
#### Example
```yaml theme={"dark"}
image: atlassian/default-image:3
pipelines:
default:
- step:
name: Build application with secrets from Infisical
script:
- apt update && apt install -y curl
- curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash
- apt-get update && apt-get install -y infisical
- export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=$INFISICAL_CLIENT_ID --client-secret=$INFISICAL_CLIENT_SECRET --silent --plain)
- infisical run --projectId=1d0443c1-cd43-4b3a-91a3-9d5f81254a89 --env=dev -- npm run build
```
Set the values of `projectId` and `env` flags in the `infisical run` command to your intended source path. For more options, refer to the CLI command reference [here](https://infisical.com/docs/cli/commands/run).
# GitHub Actions
Source: https://infisical.com/docs/integrations/cicd/githubactions
How to inject secrets from Infisical into GitHub Actions workflows using OIDC authentication
For syncing secrets **from Infisical to GitHub** (one-way sync to GitHub Secrets), use our
[GitHub Secret Syncs](../secret-syncs/github) instead.
## Concept
The [Infisical Secrets Action](https://github.com/Infisical/secrets-action) enables GitHub Actions workflows to fetch secrets from Infisical at runtime using [OpenID Connect (OIDC)](/docs/documentation/platform/identities/oidc-auth/github) authentication with [machine identities](/docs/documentation/platform/identities/machine-identities).
Instead of storing long-lived credentials in GitHub Secrets, workflows authenticate to Infisical using short-lived OIDC tokens issued by GitHub. This eliminates the need for static API keys or tokens while providing fine-grained access control based on repository, workflow, and execution context.
Secrets are fetched dynamically during workflow execution and exposed as environment variables, existing only for the lifetime of the job. This approach centralizes secret management in Infisical while maintaining security through identity-based authentication.
The short video below provides a guided overview of using Infisical with GitHub Actions and OIDC authentication, helping you build the right mental model before diving into the diagram and setup steps.
## Diagram
The following sequence diagram illustrates the OIDC authentication workflow. The authentication flow is the same for all OIDC providers; for GitHub Actions, the client is a GitHub workflow and the identity provider is GitHub's OIDC service.
```mermaid theme={"dark"}
sequenceDiagram
participant Client as GitHub Workflow
participant Idp as GitHub OIDC Provider
participant Infis as Infisical
Client->>Idp: Step 1: Request identity token
Idp-->>Client: Return JWT with verifiable claims
Note over Client,Infis: Step 2: Login Operation
Client->>Infis: Send signed JWT to /api/v1/auth/oidc-auth/login
Note over Infis,Idp: Step 3: Query verification
Infis->>Idp: Request JWT public key using OIDC Discovery
Idp-->>Infis: Return public key
Note over Infis: Step 4: JWT validation
Infis->>Client: Return short-lived access token
Note over Client,Infis: Step 5: Access Infisical API with Token
Client->>Infis: Make authenticated requests using the short-lived access token
```
In GitHub Actions, the [Infisical Secrets Action](https://github.com/Infisical/secrets-action) handles steps 1-2 and 5, automatically fetching secrets after authentication and injecting them as environment variables into your workflow.
## Workflow
A typical workflow for using Infisical with GitHub Actions consists of the following steps:
1. Create a [machine identity](/docs/documentation/platform/identities/machine-identities) in Infisical with OIDC authentication configured for your GitHub repository and workflow context.
2. Add the machine identity to your Infisical project with appropriate permissions to access the required secrets.
3. Configure your GitHub Actions workflow to use the [Infisical Secrets Action](https://github.com/Infisical/secrets-action) with OIDC authentication.
4. The workflow authenticates using GitHub's OIDC token, fetches secrets from Infisical, and exposes them as environment variables for the duration of the job.
## How It Works
GitHub Actions uses [OpenID Connect (OIDC)](/docs/documentation/platform/identities/oidc-auth/github) to authenticate workflows without storing long-lived credentials.
At a high level, the flow looks like this:
1. **GitHub Issues an [OIDC Token](https://docs.github.com/en/actions/concepts/security/openid-connect)**\
When a workflow starts, GitHub issues a short-lived OIDC token containing identity claims about the repository, workflow, and execution context.
2. **Workflow Presents Its Identity**\
The [Infisical Secrets Action](https://github.com/Infisical/secrets-action) sends this token to Infisical as proof of the workflow’s identity.
3. **Infisical Verifies Trust**\
Infisical validates the token signature using GitHub’s OIDC provider and checks the token’s subject, audience, and claims against the configured [machine identity](/docs/documentation/platform/identities/machine-identities).
4. **Secrets Are Issued at Runtime**\
If the identity matches, Infisical issues a short-lived access token. The action then uses this token to fetch only the secrets the identity is authorized to access for the requested project and environment.
Secrets are exposed to the workflow as environment variables and exist only for the lifetime of the job.
## Prerequisites
Before you begin, ensure you have:
* An [Infisical project](/docs/documentation/platform/project) ([Infisical Cloud](https://app.infisical.com) or [self-hosted instance](/docs/self-hosting/overview))
* Secrets stored in your Infisical project
* A GitHub repository with Actions enabled
## Guide
In the following steps, we explore how to configure GitHub Actions to authenticate with Infisical using OIDC and fetch secrets at runtime.
Ensure the secrets your workflow needs are stored in your Infisical project and environment (e.g., `dev`, `staging`, `prod`).
For example, a pipeline that builds and pushes a Docker image might require:
* `DOCKER_USERNAME`
* `DOCKER_PASSWORD`
Secrets are scoped to an environment. Ensure they exist in the environment your workflow will access.
A [machine identity](/docs/documentation/platform/identities/machine-identities) represents a non-human workload (such as a CI/CD pipeline, server, or automated job) and defines what that workload is authorized to access without being tied to a user account.
To create a machine identity with OIDC authentication:
1. Navigate to your project in Infisical
2. Go to your project > **Access Control** > **Machine Identities**
3. Click **Add Machine Identity to Project**
4. Provide a name for the identity (e.g., `github-actions-workflow`)
5. Select an organization-level role that defines what the identity can access
6. Click **Create**
By default, the identity will be configured with [Universal Auth](/docs/documentation/platform/identities/universal-auth). For CI/CD workflows, we want to avoid long-lived credentials, so we'll switch to OIDC authentication.
1. Click on your machine identity
2. Remove the default Universal Auth configuration
3. Click **Add auth method** and select **OIDC Auth**
Configure the following fields:
* **OIDC Discovery URL**: `https://token.actions.githubusercontent.com`
* **Issuer**: `https://token.actions.githubusercontent.com`
* **CA Certificate**: Leave blank for GitHub Actions
* **Subject**: The expected principal that is the subject of the JWT. The format is:
```
repo:/:
```
For example:
* `repo:octocat/example-repo:ref:refs/heads/main` (specific branch)
* `repo:octocat/example-repo:environment:production` (specific environment)
* `repo:octocat/example-repo:*` (any context in the repository)
If you're unsure about the exact subject format, you can use [github/actions-oidc-debugger](https://github.com/github/actions-oidc-debugger) to inspect the OIDC token claims from your workflow.
* **Audiences**: A list of intended recipients. Set this to your GitHub organization URL, for example: `https://github.com/octo-org`
* **Claims**: (Optional) Additional attributes that should be present in the JWT. Refer to GitHub's [OIDC token documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token) for supported claims.
Restrict access by configuring the Subject, Audiences, and Claims fields carefully. The Subject, Audiences, and Claims fields support glob pattern matching, but we highly recommend using hardcoded values whenever possible for better security.
Together, the Subject and Audience settings make the trust relationship explicit. Only workflows that match the repository, context, and audience you've defined will be able to authenticate and fetch secrets.
After configuring OIDC authentication, Infisical provides an **Identity ID**. This is what you'll reference in your GitHub Actions workflow.
Copy this value — you'll need it in the next step.
The Identity ID is **not a secret**. It's a public identifier that's safe to commit directly into your workflow YAML files.
## Configure GitHub Actions Workflow
Now let's configure your GitHub Actions workflow to fetch secrets from Infisical.
### Basic Workflow Example
Create or update a workflow file in `.github/workflows/` (e.g., `.github/workflows/infisical-demo.yml`):
```yaml theme={"dark"}
name: Build and Push Docker Image
on:
workflow_dispatch: # Manual trigger for testing
permissions:
id-token: write # Required for OIDC authentication
contents: read # Required for checking out code
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Fetch secrets from Infisical
uses: Infisical/secrets-action@v1.0.9
with:
method: "oidc"
identity-id: "your-identity-id-here" # From Step 4
project-slug: "your-project-slug" # Your Infisical project slug
env-slug: "dev" # Your environment slug
- name: Login to Docker Registry
run: |
echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
- name: Build and push Docker image
run: |
docker build -t my-image:latest .
docker push my-image:latest
```
### Key Configuration Points
**Permissions Block**: The `id-token: write` permission is **required** for OIDC authentication. Without it, GitHub won't issue an OIDC token for the workflow run.
**Infisical Secrets Action**: The [Infisical Secrets Action](https://github.com/Infisical/secrets-action) step handles:
* Requesting the OIDC token from GitHub
* Authenticating with Infisical using OIDC
* Fetching secrets for the specified project and environment
* Injecting secrets as environment variables
**Action Parameters**:
* `method: "oidc"` - Specifies OIDC authentication
* `identity-id` - The machine identity ID from Infisical (safe to commit)
* `project-slug` - Your Infisical project slug (found in project settings)
* `env-slug` - The environment to fetch secrets from (e.g., `dev`, `staging`, `prod`)
This workflow uses OIDC authentication with short-lived tokens. The `identity-id` is a public identifier that can be safely committed to your repository.
Authentication occurs at runtime using GitHub's OIDC token, eliminating the need to store long-lived credentials.
### Using Secrets in Workflows
After the Infisical Secrets Action completes, secrets are available as environment variables for subsequent steps in the job. Reference them using standard environment variable syntax:
```yaml theme={"dark"}
- name: Run tests with database connection
run: |
npm run test -- --database-url="$DATABASE_URL"
```
Never print full secret values in workflow logs. GitHub Actions will mask secrets automatically, but avoid using `echo $SECRET` or similar commands that expose values.
## Troubleshooting
### Authentication Failures
If authentication fails, check:
1. **Permissions**: Ensure `id-token: write` is set in the workflow permissions
2. **Subject Match**: Verify the Subject in your machine identity matches the repository and context
3. **Audience Match**: Confirm the Audience matches your GitHub organization
4. **Identity Scope**: Ensure the identity has access to the project and environment you're requesting
5. **Project Slug**: Verify the `project-slug` matches your Infisical project slug exactly. You can find this in your project settings.
6. **Environment Slug**: Confirm the `env-slug` matches the exact environment name in Infisical (e.g., `dev`, `staging`, `prod`). Environment slugs are case-sensitive and must match exactly.
### Debugging OIDC Tokens
To inspect OIDC token claims from your workflow, use GitHub's [actions-oidc-debugger](https://github.com/github/actions-oidc-debugger) tool. This tool helps you verify that the token claims match your machine identity configuration.
For more detailed OIDC configuration options and troubleshooting, see [OIDC Auth for GitHub Actions](/docs/documentation/platform/identities/oidc-auth/github).
## Alternative Approaches
### GitHub Secret Syncs
If you prefer to **push secrets from Infisical to GitHub** (one-way sync), use [GitHub Secret Syncs](../secret-syncs/github). This approach syncs secrets to GitHub at the organization-level, repository-level, or repository environment-level, making them available as GitHub Secrets.
Secret Syncs push secrets **to** GitHub, while this guide shows how to fetch secrets **from** Infisical at runtime. Choose the approach that best fits your security and operational requirements.
## Related Documentation
* [OIDC Auth for GitHub Actions](/docs/documentation/platform/identities/oidc-auth/github) - Detailed OIDC configuration guide
* [Machine Identities Overview](/docs/documentation/platform/identities/machine-identities) - Understanding machine identities
* [GitHub Secret Syncs](../secret-syncs/github) - Syncing secrets to GitHub
* [Infisical Secrets Action](https://github.com/Infisical/secrets-action) - Official GitHub Action repository
# GitLab
Source: https://infisical.com/docs/integrations/cicd/gitlab
How to sync secrets from Infisical to GitLab
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com).
Use our [GitLab Secret Syncs](../secret-syncs/gitlab)
Generate an [Infisical Token](/docs/documentation/platform/token) for the specific project and environment in Infisical.
Next, create a new variable called `INFISICAL_TOKEN` with the value set to the token from the previous step in Settings > CI/CD > Variables of your GitLab repository.
Edit your `.gitlab-ci.yml` to include the Infisical CLI installation. This will allow you to use the CLI for fetching and injecting secrets into any script or command within your Gitlab CI/CD process.
#### Example
```yaml theme={"dark"}
image: ubuntu
stages:
- build
- test
- deploy
build-job:
stage: build
script:
- apt update && apt install -y curl
- curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash
- apt-get update && apt-get install -y infisical
- infisical run -- npm run build
```
# Jenkins Plugin
Source: https://infisical.com/docs/integrations/cicd/jenkins
How to effectively and securely manage secrets in Jenkins using Infisical
**Objective**: Fetch secrets from Infisical to Jenkins pipelines
In this guide, we'll outline the steps to deliver secrets from Infisical to Jenkins via the Infisical CLI.
At a high level, the Infisical CLI will be executed within your build environment and use a machine identity to authenticate with Infisical.
This token must be added as a Jenkins Credential and then passed to the Infisical CLI as an environment variable, enabling it to access and retrieve secrets within your workflows.
Prerequisites:
* Set up and add secrets to [Infisical](https://app.infisical.com).
* Create a [machine identity](/docs/documentation/platform/identities/machine-identities) (Recommended), or a service token in Infisical.
* You have a working Jenkins installation with the [credentials plugin](https://plugins.jenkins.io/credentials/) installed.
* You have the [Infisical CLI](/docs/cli/overview) installed on your Jenkins executor nodes or container images.
## Jenkins Infisical Plugin
This plugin adds a build wrapper to set environment variables from [Infisical](https://infisical.com). Secrets are generally masked in the build log, so you can't accidentally print them.
## Installation
To install the plugin, navigate to `Manage Jenkins -> Plugins -> Available plugins` and search for `Infisical`. Install the plugin and restart Jenkins.
![Install Plugin]()
## Infisical Authentication
Authenticating with Infisical is done through the use of [Machine Identities](https://infisical.com/docs/documentation/platform/identities/machine-identities).
Currently the Jenkins plugin only supports [Universal Auth](https://infisical.com/docs/documentation/platform/identities/universal-auth) for authentication. More methods will be added soon.
### How does Universal Auth work?
To use Universal Auth, you'll need to create a new Credential *(Infisical Universal Auth Credential)*. The credential should contain your Universal Auth client ID, and your Universal Auth client secret.
Please [read more here](https://infisical.com/docs/documentation/platform/identities/universal-auth) on how to setup a Machine Identity to use universal auth.
### Creating a Universal Auth credential
Creating a universal auth credential inside Jenkins is very straight forward.
Simply navigate to
`Dashboard -> Manage Jenkins -> Credentials -> System -> Global credentials (unrestricted)`.
Press the `Add Credentials` button and select `Infisical Universal Auth Credential` in the `Kind` field.
The `ID` and `Description` field doesn't matter much in this case, as they won't be read anywhere. The description field will be displayed as the credential name during the plugin configuration.
![Infisical Universal Auth Credential]()
## Plugin Usage
### Configuration
Configuration takes place on a job-level basis.
Inside your job, you simply tick the `Infisical Plugin` checkbox under "Build Environment". After enabling the plugin, you'll see a new section appear where you'll have to configure the plugin.
![Plugin enabled]()
You'll be prompted with 4 options to fill:
* Infisical URL
* This defaults to [https://app.infisical.com](https://app.infisical.com). This field is only relevant if you're running a managed or self-hosted instance. If you are using Infisical Cloud, leave this as-is, otherwise enter the URL of your Infisical instance.
* Infisical Credential
* This is where you select your Infisical credential to use for authentication. In the step above [Creating a Universal Auth credential](#creating-a-universal-auth-credential), you can read on how to configure the credential. Simply select the credential you have created for this field.
* Infisical Project Slug
* This is the slug of the project you wish to fetch secrets from. You can find this in your project settings on Infisical by clicking "Copy project slug".
* Environment Slug
* This is the slug of the environment to fetch secrets from. In most cases it's either `dev`, `staging`, or `prod`. You can however create custom environments in Infisical. If you are using custom environments, you need to enter the slug of the custom environment you wish to fetch secrets from.
That's it! Now you're ready to select which secrets you want to fetch into Jenkins.
By clicking the `Add an Infisical secret` in the Jenkins UI like seen in the screenshot below.
![Add Infisical secret]()
You need to select which secrets that should be pulled into Jenkins.
You start by specifying a [folder path from Infisical](https://infisical.com/docs/documentation/platform/folder#comparing-folders). The root path is simply `/`. You also need to select wether or not you want to [include imports](https://infisical.com/docs/documentation/platform/secret-reference#secret-imports). Now you can add secrets the secret keys that you want to pull from Infisical into Jenkins. If you want to add multiple secrets, press the "Add key/value pair".
If you wish to pull secrets from multiple paths, you can press the "Add an Infisical secret" button at the bottom, and configure a new set of secrets to pull.
## Pipeline usage
### Generating pipeline block
Using the Infisical Plugin in a Jenkins pipeline is very straight forward. To generate a block to use the Infisical Plugin in a Pipeline, simply to go `{JENKINS_URL}/jenkins/job/{JOB_ID}/pipeline-syntax/`.
You can find a direct link on the Pipeline configuration page in the very bottom of the page, see image below.
![Pipeline Syntax Highlight]()
On the Snippet Generator page, simply configure the Infisical Plugin like it's documented in the [Configuration documentation](#configuration) step.
Once you have filled out the configuration, press `Generate Pipeline Script`, and it will generate a block you can use in your pipeline.
![Pipeline Configuration]()
### Using Infisical in a Pipeline
Using the generated block in a pipeline is very straight forward. There's a few approaches on how to implement the block in a Pipeline script.
Here's an example of using the generated block in a pipeline script. Make sure to replace the placeholder values with your own values.
The script is formatted for clarity. All these fields will be pre-filled for you if you use the `Snippet Generator` like described in the [step above](#generating-pipeline-block).
```groovy theme={"dark"}
node {
withInfisical(
configuration: [
infisicalCredentialId: 'YOUR_CREDENTIAL_ID',
infisicalEnvironmentSlug: 'PROJECT_ENV_SLUG',
infisicalProjectSlug: 'PROJECT_SLUG',
infisicalUrl: 'https://app.infisical.com' // Change this to your Infisical instance URL if you aren't using Infisical Cloud.
],
infisicalSecrets: [
infisicalSecret(
includeImports: true,
path: '/',
secretValues: [
[infisicalKey: 'DATABASE_URL'],
[infisicalKey: "API_URL"],
[infisicalKey: 'THIS_KEY_MIGHT_NOT_EXIST', isRequired: false],
]
)
]
) {
// Code runs here
sh "printenv"
}
}
```
## Add Infisical Service Token to Jenkins
After setting up your project in Infisical and installing the Infisical CLI to the environment where your Jenkins builds will run, you will need to add the Infisical Service Token to Jenkins.
To generate a Infisical service token, follow the guide [here](/docs/documentation/platform/token).
Once you have generated the token, navigate to **Manage Jenkins > Manage Credentials** in your Jenkins instance.
![Jenkins step 1]()
Click on the credential store you want to store the Infisical Service Token in. In this case, we're using the default Jenkins global store.
Each of your projects will have a different `INFISICAL_TOKEN`.
As a result, it may make sense to spread these out into separate credential domains depending on your use case.
![Jenkins step 2]()
Now, click Add Credentials.
![Jenkins step 3]()
Choose **Secret text** for the **Kind** option from the dropdown list and enter the Infisical Service Token in the **Secret** field.
Although the **ID** can be any value, we'll set it to `infisical-service-token` for the sake of this guide.
The description is optional and can be any text you prefer.
![Jenkins step 4]()
When you're done, you should see a credential similar to the one below:
![Jenkins step 5]()
## Use Infisical in a Freestyle Project
To fetch secrets with Infisical in a Freestyle Project job, you'll need to expose the credential you created above as an environment variable to the Infisical CLI.
To do so, first click **New Item** from the dashboard navigation sidebar:
![Jenkins step 6]()
Enter the name of the job, choose the **Freestyle Project** option, and click **OK**.
![Jenkins step 7]()
Scroll down to the **Build Environment** section and enable the **Use secret text(s) or file(s)** option. Then click **Add** under the **Bindings** section and choose **Secret text** from the dropdown menu.
![Jenkins step 8]()
Enter `INFISICAL_TOKEN` in the **Variable** field then click the **Specific credentials** option from the Credentials section and select the credential you created earlier.
In this case, we saved it as `Infisical service token` so we'll choose that from the dropdown menu.
![Jenkins step 9]()
Scroll down to the **Build** section and choose **Execute shell** from the **Add build step** menu.
![Jenkins step 10]()
In the command field, you can now use the Infisical CLI to fetch secrets.
The example command below will print the secrets using the service token passed as a credential. When done, click **Save**.
```
infisical secrets --env=dev --path=/
```
![Jenkins step 11]()
Finally, click **Build Now** from the navigation sidebar to run your new job.
Running into issues? Join Infisical's [community Slack](https://infisical.com/slack) for quick support.
## Use Infisical in a Jenkins Pipeline
To fetch secrets using Infisical in a Pipeline job, you'll need to expose the Jenkins credential you created above as an environment variable.
To do so, click **New Item** from the dashboard navigation sidebar:
![Jenkins step 6]()
Enter the name of the job, choose the **Pipeline** option, and click OK.
![Jenkins step 12]()
Scroll down to the **Pipeline** section, paste the following into the **Script** field, and click **Save**.
```
pipeline {
agent any
environment {
INFISICAL_TOKEN = credentials('infisical-service-token')
}
stages {
stage('Run Infisical') {
steps {
sh("infisical secrets --env=dev --path=/")
// doesn't work
// sh("docker run --rm test-container infisical secrets")
// works
// sh("docker run -e INFISICAL_TOKEN=${INFISICAL_TOKEN} --rm test-container infisical secrets --env=dev --path=/")
// doesn't work
// sh("docker-compose up -d")
// works
// sh("INFISICAL_TOKEN=${INFISICAL_TOKEN} docker-compose up -d")
}
}
}
}
```
The example provided above serves as an initial guide. It shows how Jenkins adds the `INFISICAL_TOKEN` environment variable, which is configured in the pipeline, into the shell for executing commands.
There may be instances where this doesn't work as expected in the context of running Docker commands.
However, the list of working examples should provide some insight into how this can be handled properly.
# Dynamic Secrets
Source: https://infisical.com/docs/integrations/dynamic-secrets
Browse and search through all available dynamic secrets for Infisical.
# Backstage Infisical Plugin
Source: https://infisical.com/docs/integrations/external/backstage
A powerful plugin that integrates Infisical secrets management into your Backstage developer portal.
Integrate secrets management into your developer portal with the Backstage Infisical plugin suite. This plugin provides a seamless interface to manage your [Infisical](https://infisical.com) secrets directly within Backstage, including full support for environments and folder structure.
## Features
* **Secrets Management**: View, create, update, and delete secrets from Infisical
* **Folder Navigation**: Explore the full folder structure of your Infisical projects
* **Multi-Environment Support**: Easily switch between and manage different environments
* **Entity Linking**: Map Backstage entities to specific Infisical projects via annotations
***
## Installation
### Frontend Plugin
```bash theme={"dark"}
# From your Backstage root directory
yarn --cwd packages/app add @infisical/backstage-plugin-infisical
```
### Backend Plugin
```bash theme={"dark"}
# From your Backstage root directory
yarn --cwd packages/backend add @infisical/backstage-backend-plugin-infisical
```
## Configuration
### Backend
Update your `app-config.yaml`:
```yaml theme={"dark"}
infisical:
baseUrl: https://app.infisical.com
authentication:
# Option 1: API Token Authentication
auth_token:
token: ${INFISICAL_API_TOKEN}
# Option 2: Client Credentials Authentication
universalAuth:
clientId: ${INFISICAL_CLIENT_ID}
clientSecret: ${INFISICAL_CLIENT_SECRET}
```
If you have not created a machine identity yet, you can do so in [Identities](/docs/documentation/platform/identities/machine-identities)
Register the plugin in `packages/backend/src/index.ts`:
```ts theme={"dark"}
import { createBackend } from '@backstage/backend-defaults';
const backend = createBackend();
backend.add(import('@infisical/backstage-backend-plugin-infisical'));
backend.start();
```
### Frontend
Update `packages/app/src/App.tsx` to include the plugin:
```tsx theme={"dark"}
import { infisicalPlugin } from '@infisical/backstage-plugin-infisical';
const app = createApp({
plugins: [
infisicalPlugin,
// ...other plugins
],
});
```
Modify `packages/app/src/components/catalog/EntityPage.tsx`:
```tsx theme={"dark"}
import { EntityInfisicalContent } from '@infisical/backstage-plugin-infisical';
const serviceEntityPage = (
{/* ...other tabs */}
);
```
### Entity Annotation
Add the Infisical project ID to your entity yaml settings:
```yaml theme={"dark"}
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: example-service
annotations:
infisical/projectId:
```
> Replace `` with the actual project ID from Infisical.
## Usage
Once installed and configured, you can:
1. **View and manage secrets** in Infisical from within Backstage
2. **Create, update, and delete** secrets using the Infisical tab in entity pages
3. **Navigate environments and folders**
4. **Search and filter** secrets by key, value, or comments
![Backstage Plugin Table]()
# Microsoft Power Apps
Source: https://infisical.com/docs/integrations/external/microsoft-power-apps
Fetch secrets from Infisical in Microsoft Power Apps through an Azure Function and a custom connector.
Power Apps has no native way to fetch secrets from Infisical, and hardcoding secrets in app logic exposes them to anyone with collaboration rights. This integration places an Azure Function between your Power App and Infisical: the function fetches secrets with the [Infisical .NET SDK](/docs/sdks/languages/dotnet), and the Power App calls the function through a custom connector.
## How It Works
1. The Power App invokes an Azure Function through a custom connector.
2. The function authenticates with Infisical using a [machine identity](/docs/documentation/platform/identities/machine-identities) and fetches the secret it needs.
3. The function either returns the secret to the app or uses it directly to call the target service.
There are two patterns for the last step:
| Pattern | Behavior | Use when |
| --------------------- | ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| **Return the secret** | The function returns the secret; the app passes it to another connector that calls the target service. | The function is reused by multiple consumers. |
| **Proxy the request** | The function calls the target service itself and returns only the response. The secret never reaches the app. | A single Power App is the only consumer. This keeps the secret out of the app entirely. |
## Prerequisites
* A Microsoft Power App
* An Azure subscription
* A [machine identity](/docs/documentation/platform/identities/machine-identities) with access to your Infisical project
## Setup
### 1. Create an Azure Function
Create a new Azure Function using the [Function App](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/Microsoft.FunctionApp?tab=Overview) from the Azure Marketplace.
![function app]()
Place it in a subscription using any resource group. This page uses .NET as the runtime stack, but any supported stack works. On the consumption plan, you only pay for the resources used per request.
Windows-based Azure Functions have broader tooling support than Linux. For example, Linux-based functions cannot be edited from within the Azure Management Portal.
Once the Function App is ready, add a function with the **HTTP trigger** template and the **function** authorization level. A minimal function looks like:
```csharp theme={"dark"}
using System.Net;
public static async Task Run(HttpRequestMessage req, TraceWriter log)
{
log.Info("C# HTTP trigger function processed a request.");
return req.CreateResponse(HttpStatusCode.OK, "Hello World");
}
```
The code above is written for the older runtime. You may need to change the runtime version to 1 for the Power Apps integration to work. Starting at a newer version (for example, 3) triggers a warning before the migration.
Finally, publish the Swagger (API) definitions and enable cross-origin resource sharing (CORS). The wildcard option allows all hosts; restrict it for production use.
### 2. Fetch Secrets from Infisical
Add the [Infisical .NET SDK](/docs/sdks/languages/dotnet) to the function so it can fetch secrets:
```csharp theme={"dark"}
using Infisical.Sdk;
using Infisical.Sdk.Model;
var settings = new InfisicalSdkSettingsBuilder()
// .WithHostUri("https://your-infisical-instance.com") // Optional. Defaults to https://app.infisical.com
.Build();
var client = new InfisicalClient(settings);
await client.Auth().UniversalAuth().LoginAsync(
"",
"");
var secret = await client.Secrets().GetAsync(new GetSecretOptions
{
SecretName = "API_KEY",
ProjectId = "",
EnvironmentSlug = "dev",
SecretPath = "/",
});
```
With the proxy pattern, the function uses the fetched secret to call the target service and returns only the response:
```csharp theme={"dark"}
using (var httpClient = new HttpClient())
{
httpClient.DefaultRequestHeaders
.Accept
.Add(new MediaTypeWithQualityHeaderValue("application/json"));
httpClient.DefaultRequestHeaders.Add("X-API-KEY", secret.SecretValue);
var result = await httpClient.GetAsync(apiEndpoint);
var resultContent = await result.Content.ReadAsStringAsync();
req.CreateResponse(HttpStatusCode.OK, resultContent);
}
```
### 3. Create a Custom Connector
Create the custom connector from the data pane in Power Apps using **Create from Azure Service (Preview)**:
![custom-connector]()
Fill out the fields with the information for your function. The combination boxes populate in order: select the subscription (tied to the account used to create the Power App), then the Azure Functions service, then the function itself.
Your Power App can now call the function through the connector and use secrets from Infisical without ever storing them in the app.
# Framework Integrations
Source: https://infisical.com/docs/integrations/framework-integrations
Browse and search through all available framework integrations for Infisical.
# AB Initio
Source: https://infisical.com/docs/integrations/frameworks/ab-initio
How to use Infisical secrets in AB Initio.
## Prerequisites
* Set up and add envars to [Infisical](https://app.infisical.com).
* Install the [Infisical CLI](https://infisical.com/docs/cli/overview) to your server.
## Setup
Create a [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities#machine-identities) in Infisical and give it the appropriate read permissions for the desired project and secret paths.
Update your AB Initio workflows to use Infisical CLI to inject Infisical secrets as environment variables.
```bash theme={"dark"}
# Login using the machine identity. Modify this accordingly based on the authentication method used.
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=$INFISICAL_CLIENT_ID --client-secret=$INFISICAL_CLIENT_SECRET --silent --plain)
# Fetch secrets from Infisical
infisical export --projectId="<>" --env="prod" > infisical.env
# Inject secrets as environment variables
source infisical.env
```
# Django
Source: https://infisical.com/docs/integrations/frameworks/django
How to use Infisical to inject environment variables and secrets into a Django app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Django](https://www.djangoproject.com) project
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- python manage.py runserver
```
# .NET
Source: https://infisical.com/docs/integrations/frameworks/dotnet
How to use Infisical to inject environment variables and secrets into a .NET app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [.NET](https://dotnet.microsoft.com) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- dotnet run
```
# Express, Fastify, Koa
Source: https://infisical.com/docs/integrations/frameworks/express
How to use Infisical to inject environment variables and secrets into an Express app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
The steps apply to the following non-exhaustive list of frameworks:
* [Express](https://expressjs.com)
* [Fastify](https://www.fastify.io)
* [Koa](https://koajs.com)
## Initialize Infisical for your app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run dev
```
# Fiber
Source: https://infisical.com/docs/integrations/frameworks/fiber
How to use Infisical to inject environment variables and secrets into a Fiber app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Fiber](https://gofiber.io/) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- go run server.go
```
# Flask
Source: https://infisical.com/docs/integrations/frameworks/flask
How to use Infisical to inject environment variables and secrets into a Flask app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Flask](https://flask.palletsprojects.com/en/2.2.x) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- flask run
```
# Gatsby
Source: https://infisical.com/docs/integrations/frameworks/gatsby
How to use Infisical to inject environment variables and secrets into a Gatsby app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Gatsby](https://www.gatsbyjs.com) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run develop
```
Note that for environment variables to be exposed to the client, you'll have
to prefix them with `GATSBY_`. Read more about that
[here](https://www.gatsbyjs.com/docs/how-to/local-development/environment-variables/#accessing-environment-variables-in-the-browser).
# Laravel
Source: https://infisical.com/docs/integrations/frameworks/laravel
How to use Infisical to inject environment variables and secrets into a Laravel app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Laravel](https://laravel.com/) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- php artisan serve
```
# NestJS
Source: https://infisical.com/docs/integrations/frameworks/nestjs
How to use Infisical to inject environment variables and secrets into a NestJS app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [NestJS](https://nestjs.com) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run start:dev
```
# Next.js
Source: https://infisical.com/docs/integrations/frameworks/nextjs
How to use Infisical to inject environment variables and secrets into a Next.js app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Next.js](https://nextjs.org) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run dev
```
Note that for environment variables to be exposed to the client, you'll have
to prefix them with `NEXT_PUBLIC_`. Read more about that
[here](https://nextjs.org/docs/basic-features/environment-variables).
# Nuxt
Source: https://infisical.com/docs/integrations/frameworks/nuxt
How to use Infisical to inject environment variables and secrets into a Nuxt app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Nuxt](https://nuxtjs.org) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run dev
```
# Packer
Source: https://infisical.com/docs/integrations/frameworks/packer
Learn how to fetch secrets from Infisical with Packer using a data source
This guide demonstrates how to use the Infisical Packer plugin to fetch secret data using a data source. The Packer plugin supports both [Infisical Cloud](https://app.infisical.com) and [self-hosted instances of Infisical](https://infisical.com/docs/self-hosting/overview).
## Prerequisites
Before you begin, make sure you have:
* [Packer](https://developer.hashicorp.com/packer/install) installed
* An Infisical account with access to a project
* Basic understanding of Packer
## Project Setup
### Configure Provider
First, specify the Infisical provider in your Packer configuration:
```hcl theme={"dark"}
packer {
required_plugins {
infisical = {
source = "github.com/infisical/infisical"
version = ">=0.0.1"
}
}
}
```
### Authentication
Using a Machine Identity, you can authenticate with [Universal Auth](https://infisical.com/docs/documentation/platform/identities/universal-auth).
```hcl theme={"dark"}
data "infisical-secrets" "dev-secrets" {
folder_path = "/"
env_slug = "dev" # The environment to list secrets from (e.g. dev, staging, prod)
project_id = "00000000-0000-0000-0000-000000000000"
host = "https://app.infisical.com" # Optional for cloud, required for self-hosted
universal_auth {
client_id = "00000000-0000-0000-0000-000000000000"
client_secret = "..." # Optional if using INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET env variable
}
}
```
Learn more about [machine identities](/docs/documentation/platform/identities/machine-identities).
## Using Secrets in Packer
You're able to fetch secrets from Infisical using the `infisical-secrets` Data Source:
```hcl theme={"dark"}
# Fetch all secrets from a folder
data "infisical-secrets" "dev-secrets" {
folder_path = "/"
env_slug = "dev"
project_id = "00000000-0000-0000-0000-000000000000"
universal_auth {
...
}
}
locals {
secrets = data.infisical-secrets.dev-secrets.secrets
}
source "null" "basic-example" {
communicator = "none"
}
build {
sources = [
"source.null.basic-example"
]
provisioner "shell-local" {
inline = [
"echo secret_key: ${local.secrets["SECRET_KEY"].secret_value}",
]
}
}
```
The `local.secrets` object maps secret keys to [secret objects](https://github.com/Infisical/packer-plugin-infisical/blob/main/docs/datasources/secrets.md#secret-object).
See also:
* [Packer Plugin Repository Example](https://github.com/Infisical/packer-plugin-infisical/blob/main/example/build.pkr.hcl)
* [Packer Plugin Repository Docs](https://github.com/Infisical/packer-plugin-infisical/tree/main/docs)
* [Machine Identity setup guide](/docs/documentation/platform/identities/machine-identities)
# Pulumi
Source: https://infisical.com/docs/integrations/frameworks/pulumi
Using Infisical with Pulumi via the Terraform Bridge
Infisical can be integrated with Pulumi by leveraging Pulumi’s [Terraform Bridge](https://www.pulumi.com/blog/any-terraform-provider/),
which allows Terraform providers to be used seamlessly within Pulumi projects. This enables infrastructure and platform teams to manage Infisical secrets and resources
using Pulumi’s familiar programming languages (including TypeScript, Python, Go, and C#), without any change to existing workflows.
The Terraform Bridge wraps the [Infisical Terraform provider](https://registry.terraform.io/providers/Infisical/infisical/latest/docs) and exposes its resources (such as `infisical_secret`, `infisical_project`, and `infisical_service_token`)
in a Pulumi-compatible interface. This makes it easy to integrate secret management directly into Pulumi-based IaC pipelines, ensuring secrets stay in sync with
the rest of your cloud infrastructure. Authentication is handled through the same methods as Terraform: using environment variables such as `INFISICAL_TOKEN` and `INFISICAL_SITE_URL`.
By bridging the Infisical provider, teams using Pulumi can adopt secure, centralized secrets management without compromising on their toolchain or language preferences.
# Ruby on Rails
Source: https://infisical.com/docs/integrations/frameworks/rails
How to use Infisical to inject environment variables and secrets into a Ruby on Rails app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Rails](https://rubyonrails.org) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- bin/rails server
```
# React
Source: https://infisical.com/docs/integrations/frameworks/react
How to use Infisical to inject environment variables and secrets into a React app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Create React App](https://create-react-app.dev)
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run dev
```
React environment variables must be prefixed with `REACT_APP_` to show up within the application
# Remix
Source: https://infisical.com/docs/integrations/frameworks/remix
How to use Infisical to inject environment variables and secrets into a Remix app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Remix](https://remix.run) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run dev
```
# Spring Boot with Maven
Source: https://infisical.com/docs/integrations/frameworks/spring-boot-maven
How to use Infisical to inject environment variables into Java Spring Boot
Prerequisites:
* Set up and add your environment variables to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical
In order for Infisical to know which secrets to fetch, you'll need to first initialize Infisical at the root of your project.
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application with Maven wrapper
To pass in Infisical secrets into your application, we will utilize the Infisical CLI to inject the secrets into the Maven wrapper executable, which is used to launch your application.
The Maven wrapper executable should already be present in the root directory of your project.
```bash theme={"dark"}
infisical run -- ./mvnw spring-boot:run --quiet
```
#### Accessing injected secrets
```java example.java theme={"dark"}
...
import org.springframework.core.env.Environment;
@SpringBootApplication
public class DemoApplication {
@Autowired
private Environment env;
@Bean
public void someMethod() {
System.out.println(env.getProperty("SOME_SECRET_NAME"));
};
}
```
## Debugging with secrets
During the process of debugging your code, it may be necessary to have certain environment variables available. To inject these variables for the purpose of debugging, please follow the instructions provided below.
Note that these instructions are currently only available for IntelliJ.
**Step 1:** On the main tool bar, choose Edit Configuration
![]()
**Step 2:** Click the plus icon
![]()
**Step 3:** Select Shell Script
![]()
**Step 4:** Choose Script Text and then paste in the command below.
![]()
```
infisical run -- ./mvnw spring-boot:run -Dspring-boot.run.jvmArguments="-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=*:5005"
```
**Step 5:** When you need to run a block of code in debug mode, select the Infisical script
![]()
# SvelteKit
Source: https://infisical.com/docs/integrations/frameworks/sveltekit
How to use Infisical to inject environment variables and secrets into a SvelteKit app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [SvelteKit](https://kit.svelte.dev) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run dev
```
Note that for environment variables to be exposed to the client, you'll have
to prefix them with `PUBLIC_`. Read more about that
[here](https://kit.svelte.dev/docs/modules#\$env-static-public).
# Terraform
Source: https://infisical.com/docs/integrations/frameworks/terraform
Learn how to fetch secrets from Infisical with Terraform using both traditional data sources and ephemeral resources
# Vite
Source: https://infisical.com/docs/integrations/frameworks/vite
How to use Infisical to inject environment variables and secrets into a Vite app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Vite](https://vitejs.dev) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize Infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run dev
```
Note that for environment variables to be exposed to the client, you'll have
to prefix them with `VITE_` and export them from the `vite.config.js` file.
Read more about that [here](https://vitejs.dev/guide/env-and-mode.html) and
[here](https://main.vitejs.dev/config).
# Vue
Source: https://infisical.com/docs/integrations/frameworks/vue
How to use Infisical to inject environment variables and secrets into a Vue.js app.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* [Install the CLI](/docs/cli/overview)
## Initialize Infisical for your [Vue](https://vuejs.org) app
```bash theme={"dark"}
# navigate to the root of your of your project
cd /path/to/project
# then initialize infisical
infisical init
```
## Start your application as usual but with Infisical
```bash theme={"dark"}
infisical run --
# Example
infisical run -- npm run dev
```
Note that for environment variables to be exposed to the client, you'll have
to prefix them with `VUE_APP` Read more about that
[here](https://cli.vuejs.org/guide/mode-and-env.html).
# Machine Authentication
Source: https://infisical.com/docs/integrations/machine-authentication
Browse and search through all available machine authentication methods for Infisical.
# Ansible
Source: https://infisical.com/docs/integrations/platforms/ansible
Learn how to use Infisical for secret management in Ansible.
You can find the Infisical Ansible collection on [Ansible Galaxy](https://galaxy.ansible.com/ui/repo/published/infisical/vault/).
This Ansible Infisical collection includes a variety of Ansible content to help automate the management of Infisical services. This collection is maintained by the Infisical team.
## Ansible version compatibility
Tested with the Ansible Core >= 2.12.0 versions, and the current development version of Ansible. Ansible Core versions prior to 2.12.0 have not been tested.
## Python version compatibility
This collection depends on the Infisical SDK for Python.
Requires Python 3.7 or greater.
## Installing this collection
You can install the Infisical collection with the Ansible Galaxy CLI:
```bash theme={"dark"}
ansible-galaxy collection install infisical.vault
```
The python module dependencies are not installed by ansible-galaxy. They can be manually installed using pip:
```bash theme={"dark"}
pip install infisicalsdk
```
## Using this collection
You can either call modules by their Fully Qualified Collection Name (FQCN), such as `infisical.vault.read_secrets`, or you can call modules by their short name if you list the `infisical.vault` collection in the playbook's collections keyword.
## Authentication
The Infisical Ansible Collection supports [Universal Auth](/docs/documentation/platform/identities/universal-auth), [OIDC Auth](/docs/documentation/platform/identities/oidc-auth/general), [LDAP Auth](/docs/documentation/platform/identities/ldap-auth/general), and [Token Auth](/docs/documentation/platform/identities/token-auth) for authenticating against Infisical.
### Login Module (Recommended)
The recommended approach is to use the `login` module to authenticate once and reuse the credentials across multiple tasks. This reduces authentication overhead and makes playbooks cleaner. Alternatively, you can still pass credentials directly to each plugin/module if preferred.
```yaml theme={"dark"}
- name: Login to Infisical
infisical.vault.login:
url: "https://app.infisical.com"
auth_method: universal_auth
universal_auth_client_id: "{{ client_id }}"
universal_auth_client_secret: "{{ client_secret }}"
register: infisical_login
- name: Read secrets using cached login
infisical.vault.read_secrets:
login_data: "{{ infisical_login.login_data }}"
project_id: "{{ project_id }}"
env_slug: "dev"
path: "/"
as_dict: true
register: secrets
- name: Use the secrets
debug:
msg: "Database URL is {{ secrets.secrets.DATABASE_URL }}"
```
Using Universal Auth for authentication is the most straight-forward way to get started with using the Ansible collection.
To use Universal Auth, you need to provide the Client ID and Client Secret of your Infisical Machine Identity.
```yaml theme={"dark"}
- name: Login with Universal Auth
infisical.vault.login:
url: "https://app.infisical.com"
auth_method: universal_auth
universal_auth_client_id: ""
universal_auth_client_secret: ""
register: infisical_login
```
You can also provide the `auth_method`, `universal_auth_client_id`, and `universal_auth_client_secret` parameters through environment variables:
| Parameter Name | Environment Variable Name |
| ------------------------------ | ---------------------------------------- |
| `auth_method` | `INFISICAL_AUTH_METHOD` |
| `universal_auth_client_id` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` |
| `universal_auth_client_secret` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` |
To use OIDC Auth, you'll need to provide the ID of your machine identity, and the OIDC JWT to be used for authentication.
Please note that in order to use OIDC Auth, you must have `1.0.10` or newer of the `infisicalsdk` package installed.
```yaml theme={"dark"}
- name: Login with OIDC Auth
infisical.vault.login:
url: "https://app.infisical.com"
auth_method: oidc_auth
identity_id: ""
jwt: ""
register: infisical_login
```
You can also provide the `auth_method`, `identity_id`, and `jwt` parameters through environment variables:
| Parameter Name | Environment Variable Name |
| -------------- | ------------------------- |
| auth\_method | `INFISICAL_AUTH_METHOD` |
| identity\_id | `INFISICAL_IDENTITY_ID` |
| jwt | `INFISICAL_JWT` |
LDAP Auth allows you to authenticate with Infisical using a machine identity configured with an LDAP directory. You need to provide the identity ID and your LDAP username and password.
Please note that in order to use LDAP Auth, you must have `1.0.16` or newer of the `infisicalsdk` package installed.
```yaml theme={"dark"}
- name: Login with LDAP Auth
infisical.vault.login:
url: "https://app.infisical.com"
auth_method: ldap_auth
identity_id: ""
username: ""
password: ""
register: infisical_login
```
You can also provide the `auth_method`, `identity_id`, `username`, and `password` parameters through environment variables:
| Parameter Name | Environment Variable Name |
| -------------- | ------------------------- |
| auth\_method | `INFISICAL_AUTH_METHOD` |
| identity\_id | `INFISICAL_IDENTITY_ID` |
| username | `INFISICAL_LDAP_USERNAME` |
| password | `INFISICAL_LDAP_PASSWORD` |
Token Auth is the simplest authentication method that allows you to authenticate directly with an access token. This can be either a [Machine Identity Token Auth](/docs/documentation/platform/identities/token-auth) token or a User JWT token.
Please note that in order to use Token Auth, you must have `1.0.13` or newer of the `infisicalsdk` package installed.
```yaml theme={"dark"}
- name: Login with Token Auth
infisical.vault.login:
url: "https://app.infisical.com"
auth_method: token_auth
token: ""
register: infisical_login
no_log: true
```
Your token is returned as-is in `login_data.access_token` so it can be reused in later tasks. As a result, Ansible no longer masks it, and it can appear in:
* Verbose output (`-v`/`-vvv`)
* Log files (`ANSIBLE_LOG_PATH`)
* CI/CD logs
Always set `no_log: true` on the login task, as shown above, to keep the token out of output and logs.
You can also provide the `auth_method` and `token` parameters through environment variables:
| Parameter Name | Environment Variable Name |
| -------------- | ------------------------- |
| auth\_method | `INFISICAL_AUTH_METHOD` |
| token | `INFISICAL_TOKEN` |
## Available Plugins and Modules
### Lookup Plugins
* `infisical.vault.login` - Authenticate and return reusable login data
* `infisical.vault.read_secrets` - Read secrets from Infisical
### Modules
**Authentication:**
* `infisical.vault.login` - Authenticate and return reusable login data
**Static Secrets:**
* `infisical.vault.read_secrets` - Read secrets from Infisical
* `infisical.vault.create_secret` - Create a new secret
* `infisical.vault.update_secret` - Update an existing secret
* `infisical.vault.delete_secret` - Delete a secret
**Dynamic Secrets:**
* `infisical.vault.create_dynamic_secret` - Create a dynamic secret configuration
* `infisical.vault.get_dynamic_secret` - Get a dynamic secret by name
* `infisical.vault.update_dynamic_secret` - Update a dynamic secret
* `infisical.vault.delete_dynamic_secret` - Delete a dynamic secret
**Dynamic Secret Leases:**
* `infisical.vault.create_dynamic_secret_lease` - Create a lease (generates credentials)
* `infisical.vault.get_dynamic_secret_lease` - Get lease details
* `infisical.vault.renew_dynamic_secret_lease` - Renew an existing lease
* `infisical.vault.delete_dynamic_secret_lease` - Delete/revoke a lease
## Examples
### Reading Secrets
```yaml theme={"dark"}
---
- name: Read secrets from Infisical
hosts: localhost
gather_facts: false
tasks:
- name: Login to Infisical
infisical.vault.login:
url: "https://app.infisical.com"
auth_method: universal_auth
universal_auth_client_id: "{{ lookup('env', 'INFISICAL_CLIENT_ID') }}"
universal_auth_client_secret: "{{ lookup('env', 'INFISICAL_CLIENT_SECRET') }}"
register: infisical_login
- name: Read all secrets as dictionary
infisical.vault.read_secrets:
login_data: "{{ infisical_login.login_data }}"
project_id: "your-project-id"
env_slug: "dev"
path: "/"
as_dict: true
register: secrets
- name: Use the secrets
debug:
msg: "Database: {{ secrets.secrets.DATABASE_URL }}"
```
#### Reading secrets with full metadata
Use the `raw` option to retrieve complete secret metadata including version, creation time, tags, and more:
```yaml theme={"dark"}
- name: Read all secrets with full metadata
infisical.vault.read_secrets:
login_data: "{{ infisical_login.login_data }}"
project_id: "your-project-id"
env_slug: "dev"
path: "/"
raw: true
register: raw_secrets
# Returns: [{"id": "...", "secretKey": "HOST", "secretValue": "google.com", "version": 1, "type": "shared", ...}, ...]
- name: Read all secrets with full metadata as dict
infisical.vault.read_secrets:
login_data: "{{ infisical_login.login_data }}"
project_id: "your-project-id"
env_slug: "dev"
path: "/"
raw: true
as_dict: true
register: raw_secrets_dict
# Returns: {"HOST": {"id": "...", "secretKey": "HOST", "secretValue": "google.com", "version": 1, ...}, ...}
```
#### Using the Lookup Plugin
The `read_secrets` lookup plugin allows for inline secret retrieval. Unlike modules that run on target hosts, lookup plugins run on the Ansible controller during playbook parsing. This is useful for retrieving secrets to use in variable definitions:
```yaml theme={"dark"}
vars:
read_all_secrets_within_scope: "{{ lookup('infisical.vault.read_secrets', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://app.infisical.com') }}"
# [{ "key": "HOST", "value": "google.com" }, { "key": "SMTP", "value": "gmail.smtp.edu" }]
read_all_secrets_as_dict: "{{ lookup('infisical.vault.read_secrets', as_dict=True, universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://app.infisical.com') }}"
# { "SECRET_KEY_1": "secret-value-1", "SECRET_KEY_2": "secret-value-2" } -> Can be accessed as secrets.SECRET_KEY_1
read_secret_by_name_within_scope: "{{ lookup('infisical.vault.read_secrets', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', secret_name='HOST', url='https://app.infisical.com') }}"
# { "key": "HOST", "value": "google.com" }
```
### Managing Secrets (CRUD)
Create, update, and delete secrets programmatically:
```yaml theme={"dark"}
- name: Create a secret
infisical.vault.create_secret:
login_data: "{{ infisical_login.login_data }}"
project_id: "{{ project_id }}"
env_slug: "dev"
path: "/"
secret_name: "API_KEY"
secret_value: "my-api-key"
secret_comment: "API key for external service"
register: created_secret
- name: Update a secret
infisical.vault.update_secret:
login_data: "{{ infisical_login.login_data }}"
project_id: "{{ project_id }}"
env_slug: "dev"
path: "/"
secret_name: "API_KEY"
secret_value: "new-api-key"
register: updated_secret
- name: Rename a secret
infisical.vault.update_secret:
login_data: "{{ infisical_login.login_data }}"
project_id: "{{ project_id }}"
env_slug: "dev"
path: "/"
secret_name: "OLD_SECRET_NAME"
new_secret_name: "NEW_SECRET_NAME"
register: renamed_secret
- name: Delete a secret
infisical.vault.delete_secret:
login_data: "{{ infisical_login.login_data }}"
project_id: "{{ project_id }}"
env_slug: "dev"
path: "/"
secret_name: "API_KEY"
register: deleted_secret
```
### Dynamic Secrets
Dynamic secrets generate credentials on-demand with automatic expiration. They support various providers like SQL databases, AWS, GCP, Azure, and more. For the full list of supported providers and their configuration options, see the [Dynamic Secrets documentation](/docs/documentation/platform/dynamic-secrets/overview).
#### Creating a Dynamic Secret
```yaml theme={"dark"}
# Create a dynamic secret for PostgreSQL
- name: Create a PostgreSQL dynamic secret
infisical.vault.create_dynamic_secret:
login_data: "{{ infisical_login.login_data }}"
project_slug: "my-project"
env_slug: "dev"
path: "/"
name: "postgres-dev"
provider_type: "sql-database"
inputs:
client: "postgres"
host: "localhost"
port: 5432
database: "mydb"
username: "admin"
password: "admin-password"
creationStatement: "CREATE USER \"{{username}}\" WITH PASSWORD '{{password}}';"
revocationStatement: "DROP USER \"{{username}}\";"
default_ttl: "1h"
max_ttl: "24h"
register: dynamic_secret
```
For the full list of supported provider types and their input configurations, see the [Dynamic Secrets API Documentation](https://infisical.com/docs/api-reference/endpoints/dynamic-secrets/create#body-provider).
#### Getting and Using Dynamic Secret Credentials
To use a dynamic secret, you need to create a **lease** which generates the actual credentials:
```yaml theme={"dark"}
# Create a lease to get database credentials
- name: Get database credentials
infisical.vault.create_dynamic_secret_lease:
login_data: "{{ infisical_login.login_data }}"
project_slug: "my-project"
env_slug: "dev"
path: "/"
dynamic_secret_name: "postgres-dev"
ttl: "30m"
register: lease
# Use the generated credentials
- name: Connect to database
community.postgresql.postgresql_query:
login_host: localhost
login_user: "{{ lease.data.DB_USERNAME }}"
login_password: "{{ lease.data.DB_PASSWORD }}"
db: mydb
query: "SELECT version();"
```
#### Managing Leases
```yaml theme={"dark"}
# Get lease details
- name: Get lease information
infisical.vault.get_dynamic_secret_lease:
login_data: "{{ infisical_login.login_data }}"
project_slug: "my-project"
env_slug: "dev"
path: "/"
lease_id: "{{ lease.lease.id }}"
register: lease_details
# Renew a lease before it expires
- name: Renew a lease for 2 more hours
infisical.vault.renew_dynamic_secret_lease:
login_data: "{{ infisical_login.login_data }}"
project_slug: "my-project"
env_slug: "dev"
path: "/"
lease_id: "{{ lease.lease.id }}"
ttl: "2h"
register: renewed_lease
# Revoke the credentials when done
- name: Delete the lease
infisical.vault.delete_dynamic_secret_lease:
login_data: "{{ infisical_login.login_data }}"
project_slug: "my-project"
env_slug: "dev"
path: "/"
lease_id: "{{ lease.lease.id }}"
```
#### Updating and Deleting Dynamic Secrets
```yaml theme={"dark"}
# Update a dynamic secret's TTL
- name: Update dynamic secret TTL
infisical.vault.update_dynamic_secret:
login_data: "{{ infisical_login.login_data }}"
project_slug: "my-project"
env_slug: "dev"
path: "/"
name: "postgres-dev"
default_ttl: "2h"
max_ttl: "48h"
register: updated_secret
# Delete a dynamic secret (also revokes all active leases)
- name: Delete a dynamic secret
infisical.vault.delete_dynamic_secret:
login_data: "{{ infisical_login.login_data }}"
project_slug: "my-project"
env_slug: "dev"
path: "/"
name: "postgres-dev"
register: deleted_secret
```
## Troubleshoot
If you get this Python error when you running the lookup plugin:
```
objc[72832]: +[__NSCFConstantString initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug.
Fatal Python error: Aborted
```
You will need to add this to your shell environment or ansible wrapper script:
```
export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
```
# Apache Airflow
Source: https://infisical.com/docs/integrations/platforms/apache-airflow
Learn how to use Infisical as your custom secrets backend in Apache Airflow.
# AWS Lambda
Source: https://infisical.com/docs/integrations/platforms/aws/lambda
How to use Infisical secrets in AWS Lambda
Learn how to sync Infisical secrets to AWS Lambda regardless of how you deploy your function. This guide covers the following strategies:
* Infisical SDKs
* AWS Secrets Manager integration
* AWS Systems Manager Parameter Store integration
* AWS CLI
## Choose your sync strategy
### 1. Fetch secrets at runtime with Infisical SDKs
If you control the Lambda code, the simplest method is to fetch secrets directly from Infisical using one of our SDKs.\
You can read more about the Infisical SDKs [here](/docs/sdks/overview).
### 2. Push via secret sync
Configure a secret sync from your Infisical project, and Infisical will keep your Secrets Manager or Parameter Store values up to date. Your Lambda function can then reference those secrets directly.\
Learn more about the [AWS Secrets Manager integration](/docs/integrations/secret-syncs/aws-secrets-manager) and the [AWS Parameter Store integration](/docs/integrations/secret-syncs/aws-parameter-store).
### 3. Push environment variables directly using the AWS CLI
For straightforward workflows or quick rotations, you can push Infisical secrets directly into Lambda environment variables using the AWS CLI.
## Prerequisites
* AWS CLI v2 installed and authenticated
* `jq` installed locally
* An IAM principal with `lambda:UpdateFunctionConfiguration`
* Infisical CLI (`infisical`) configured
### IAM permissions
Attach a policy like the one below to the IAM user or role responsible for updating Lambda configuration:
```json theme={"dark"}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "LambdaConfig",
"Effect": "Allow",
"Action": ["lambda:UpdateFunctionConfiguration"],
"Resource": "*"
}
]
}
```
Replacing Lambda environment variables using the AWS CLI overwrites the entire
`Variables` object. Make sure to export your current values so you can import them
into Infisical.
#### Push secrets to Lambda
Use the Infisical CLI to export secrets as JSON and pass them to the AWS CLI.
The example below targets a project by ID, but you can also use the `--project` and `--env` flags.
Learn more about `infisical export` [here](/docs/cli/commands/export#infisical-export).
```bash theme={"dark"}
FUNCTION_NAME=infisical-env-test
REGION=us-east-1
PROJECT_ID=1234567890
aws lambda update-function-configuration \
--function-name "$FUNCTION_NAME" \
--region "$REGION" \
--environment "$(
infisical export \
--format=json \
--projectId="$PROJECT_ID" \
| jq 'map({(.key): .value}) | add | {Variables: .}'
)"
```
On success, the updated `Environment.Variables` block will be returned.
Verify the values in the Lambda console or by invoking the function.
Automate this step in CI/CD. Run `infisical export` using an Infisical Token
scoped to your project and environment, and trigger the sync as part of your
deployment workflow. Learn more about the [Infisical
Token](/docs/cli/commands/export#infisical-export:infisical-token).
We recommend using automatic secret syncs to AWS Secrets Manager or AWS
Parameter Store to keep your secrets continuously in sync and avoid manually
updating the Lambda configuration.
# Docker Entrypoint
Source: https://infisical.com/docs/integrations/platforms/docker
Learn how to use Infisical to inject environment variables into a Docker container.
This approach allows you to inject secrets from Infisical directly into your application.
This is achieved by installing the Infisical CLI into your docker image and modifying your start command to execute with Infisical.
## Install the Infisical CLI to your Dockerfile
To install the CLI, follow the instructions for your chosen distribution [here](/docs/cli/overview).
####
We recommend you to set the version of the CLI to a specific version. This will help keep your CLI version consistent across reinstalls. [View versions](https://github.com/Infisical/cli/releases)
## Modify the start command in your Dockerfile
Starting your service with the Infisical CLI pulls your secrets from Infisical and injects them into your service.
```dockerfile theme={"dark"}
CMD ["infisical", "run", "--projectId", "", "--", "[your service start command]"]
# example with single single command
CMD ["infisical", "run", "--projectId", "", "--", "npm", "run", "start"]
# example with multiple commands
CMD ["infisical", "run", "--projectId", "", "--command", "npm run start && ..."]
```
Generate a machine identity for your project by following the steps in the [Machine Identity](/docs/documentation/platform/identities/machine-identities) guide. The machine identity will allow you to authenticate and fetch secrets from Infisical.
Obtain an access token for the machine identity by running the following command:
```bash theme={"dark"}
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id= --client-secret= --plain --silent)
```
Please note that the access token has a limited lifespan. The `infisical token renew` command can be used to renew the token if needed.
The last step is to give the Infisical CLI installed in your Docker container access to the access token. This will allow the CLI to fetch and inject the secrets into your application.
To feed the access token to the container, use the INFISICAL\_TOKEN environment variable as shown below.
```bash theme={"dark"}
docker run --env INFISICAL_TOKEN=$INFISICAL_TOKEN [DOCKER-IMAGE]...
```
### Using a Starting Script
The drawback of the previous method is that you would have to generate the `INFISICAL_TOKEN` manually. To automate this process, you can use a shell script as your starting command.
Create a machine identity for your project by following the steps in the [Machine Identity](/docs/documentation/platform/identities/machine-identities) guide. This identity will enable authentication and secret retrieval from Infisical.
Create a shell script to obtain an access token for the machine identity:
```bash script.sh theme={"dark"}
#!/bin/sh
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=$INFISICAL_MACHINE_CLIENT_ID --client-secret=$INFISICAL_MACHINE_CLIENT_SECRET --plain --silent)
exec infisical run --token $INFISICAL_TOKEN --projectId $PROJECT_ID --env $INFISICAL_SECRET_ENV --domain $INFISICAL_API_URL --
```
> **Note:** The access token has a limited lifespan. Use the [infisical token renew](/docs/cli/commands/token) CLI command to renew it when necessary.
Caution: Implementing this directly in your Dockerfile presents two key issues:
1. Lack of persistence: Variables set in one build step are not automatically carried over to subsequent steps, complicating the process.
2. Security risk: It exposes sensitive credentials inside your container, potentially allowing anyone with container access to retrieve them.
Grant the Infisical CLI access to the access token, inside your Docker container. This allows the CLI to fetch and inject secrets into your application.
Add the following line to your Dockerfile:
```dockerfile theme={"dark"}
CMD ["./script.sh"]
```
```dockerfile theme={"dark"}
CMD ["infisical", "run", "--", "[your service start command]"]
# example with single single command
CMD ["infisical", "run", "--", "npm", "run", "start"]
# example with multiple commands
CMD ["infisical", "run", "--command", "npm run start && ..."]
```
Head to your project settings in the Infisical dashboard to generate an [service token](/docs/documentation/platform/token).
This service token will allow you to authenticate and fetch secrets from Infisical.
Once you have created a service token with the required permissions, you’ll need to feed the token to the CLI installed in your docker container.
The last step is to give the Infisical CLI installed in your Docker container access to the service token. This will allow the CLI to fetch and inject the secrets into your application.
To feed the service token to the container, use the INFISICAL\_TOKEN environment variable as shown below.
```bash theme={"dark"}
docker run --env INFISICAL_TOKEN=[token] [DOCKER-IMAGE]...
```
# Docker Compose
Source: https://infisical.com/docs/integrations/platforms/docker-compose
Find out how to use Infisical to inject environment variables into services defined in your Docker Compose file.
Prerequisites:
* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
## Configure the Infisical CLI for each service
Follow this [guide](./docker) to configure the Infisical CLI for each service that you wish to inject environment variables into; you'll have to update the Dockerfile of each service.
### Generate and configure machine identity
Generate a machine identity for each service you want to inject secrets into. You can do this by following the steps in the [Machine Identity](/docs/documentation/platform/identities/machine-identities) guide.
### Set the machine identity client ID and client secret as environment variables
For each service you want to inject secrets into, generate the required `INFISICAL_TOKEN_SERVICE_A` and `INFISICAL_TOKEN_SERVICE_B`.
```yaml theme={"dark"}
# Example Docker Compose file
services:
web:
build: .
image: example-service-1
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_SERVICE_A}
api:
build: .
image: example-service-2
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_SERVICE_B}
```
### Export shell variables
Next, set the shell variables you defined in your compose file. This can be done manually or via your CI/CD environment. Once done, it will be used to populate the corresponding `INFISICAL_TOKEN_SERVICE_A` and `INFISICAL_TOKEN_SERVICE_B` in your Docker Compose file.
```bash theme={"dark"}
#Example
# Token refers to the token we generated in step 2 for this service
export INFISICAL_TOKEN_SERVICE_A=$(infisical login --method=universal-auth --client-id= --client-secret= --silent --plain)
export INFISICAL_TOKEN_SERVICE_B=$(infisical login --method=universal-auth --client-id= --client-secret= --silent --plain)
# Then run your compose file in the same terminal.
docker-compose ...
```
## Generate service token
Generate a unique [Service Token](/docs/documentation/platform/token) for each service.
## Feed service token to your Docker Compose file
For each service you want to inject secrets into, set an environment variable called `INFISICAL_TOKEN` equal to a unique identifier variable.
In the example below, we set `INFISICAL_TOKEN_FOR_WEB` and `INFISICAL_TOKEN_FOR_API` as the `INFISICAL_TOKEN` for the services.
```yaml theme={"dark"}
# Example Docker Compose file
services:
web:
build: .
image: example-service-1
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_FOR_WEB}
api:
build: .
image: example-service-2
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_FOR_API}
```
## Export shell variables
Next, set the shell variables you defined in your compose file. This can be done manually or via your CI/CD environment. Once done, it will be used to populate the corresponding `INFISICAL_TOKEN`
in your Docker Compose file.
```bash theme={"dark"}
#Example
# Token refers to the token we generated in step 2 for this service
export INFISICAL_TOKEN_FOR_WEB=
# Token refers to the token we generated in step 2 for this service
export INFISICAL_TOKEN_FOR_API=
# Then run your compose file in the same terminal.
docker-compose ...
```
# Docker
Source: https://infisical.com/docs/integrations/platforms/docker-intro
Learn how to feed secrets from Infisical into your Docker application.
There are many methods to inject Infisical secrets into Docker-based applications.
Regardless of the method you choose, they all inject secrets from Infisical as environment variables into your Docker container.
Watch the video below for an overview of managing environment variables in Docker, covering Docker Compose, Docker secrets, and injection with the Infisical CLI.
Install and run your app start command with Infisical CLI
Feed secrets with the `--env-file` flag when using the
`docker run` command
Inject secrets into multiple services using Docker Compose
The main difference between the "Docker Entrypoint" and "Docker run" approach is where the Infisical CLI is installed.
In most production settings, it's typically less convenient to have the Infisical CLI installed and executed externally, so we suggest using the "Docker Entrypoint" method for production purposes.
However, if this limitation doesn't apply to you, select the method that best fits your needs.
# Docker Run
Source: https://infisical.com/docs/integrations/platforms/docker-pass-envs
Learn how to pass secrets to your docker container at run time.
This method allows you to feed secrets from Infisical into your container using the `--env-file` flag of `docker run` command.
Rather than giving the flag a file path to your env file, you'll use the Infisical CLI to create a virtual file path.
For this method to function as expected, you must have a bash shell (for processing substitution) and the [Infisical CLI](../../cli/overview) installed in the environment where you will be running the `docker run` command.
## 1. Authentication
If you are already logged in via the CLI you can skip this step. Otherwise, head to your organization settings in Infisical Cloud to create a [Machine Identity](../../documentation/platform/identities/machine-identities). The machine identity will allow you to authenticate and fetch secrets from Infisical.
Once you have created a machine identity with the required permissions, you'll need to feed the token to the CLI.
Please note that we highly recommend using `infisical login` for local development.
#### Pass as flag
You may use the --token flag to set the token
```bash theme={"dark"}
infisical export --token=<>
```
#### Pass via shell environment variable
The CLI is configured to look for an environment variable named `INFISICAL_TOKEN`. If set, it'll attempt to use it for authentication.
```bash theme={"dark"}
export INFISICAL_TOKEN=<>
```
You can use the `infisical login --method=universal-auth` command to directly obtain a universal auth access token and set it as an environment variable.
```bash theme={"dark"}
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id= --client-secret= --silent --plain)
```
In production scenarios, please to avoid using the `infisical login` command and instead use a [machine identity](../../documentation/platform/identities/machine-identities).
## 2. Run your docker command with Infisical
Next, use the --env-file flag of the `docker run` command with Infisical CLI to point to your secrets.
Under the hood, this command will fetch secrets from Infisical and serve them as a file to the `--env-file` flag.
```bash theme={"dark"}
# In this example, executing a docker run command will initiate an empty Alpine container and display the environment variables passed to it by Infisical.
docker run --rm --env-file <(infisical export --format=dotenv) alpine printenv
```
To view all options of the `export` command, click [here](../../cli/commands/export)
When using the --env-file option, Docker does not have the capability to support secrets that span multiple lines.
# Amazon ECS
Source: https://infisical.com/docs/integrations/platforms/ecs-with-agent
Learn how to deliver secrets to Amazon Elastic Container Service.
![ecs diagram]()
This guide will go over the steps needed to access secrets stored in Infisical from Amazon Elastic Container Service (ECS).
At a high level, the steps involve setting up an ECS task with an [Infisical Agent](/docs/integrations/platforms/infisical-agent) as a sidecar container. This sidecar container uses [AWS Auth](/docs/documentation/platform/identities/aws-auth) to authenticate with Infisical to fetch secrets/access tokens.
Once the secrets/access tokens are retrieved, they are then stored in a shared [Amazon Elastic File System](https://aws.amazon.com/efs/) (EFS) volume. This volume is then made accessible to your application and all of its replicas.
This guide primarily focuses on integrating Infisical Cloud with Amazon ECS on AWS Fargate and Amazon EFS.
However, the principles and steps can be adapted for use with any instance of Infisical (on premise or cloud) and different ECS launch configurations.
## Prerequisites
This guide requires the following prerequisites:
* Infisical account
* Git installed
* Terraform v1.0 or later installed
* Access to AWS credentials
* Understanding of [Infisical Agent](/docs/integrations/platforms/infisical-agent)
## What we will deploy
For this demonstration, we'll deploy the [File Browser](https://github.com/filebrowser/filebrowser) application on our ECS cluster.
Although this guide focuses on File Browser, the principles outlined here can be applied to any application of your choice.
File Browser plays a key role in this context because it enables us to view all files attached to a specific volume.
This feature is important for our demonstration, as it allows us to verify whether the Infisical agent is depositing the expected files into the designated file volume and if those files are accessible to the application.
Volumes that contain sensitive secrets should not be publicly accessible. The
use of File Browser here is solely for demonstration and verification
purposes.
## Configure Authentication with Infisical
In order for the Infisical agent to fetch credentials from Infisical, we'll first need to authenticate with Infisical. Follow the documentation to configure a machine identity with AWS Auth [here](/docs/documentation/platform/identities/aws-auth).
Take note of the Machine Identity ID as you will be needing this in the preceding steps.
## Clone guide assets repository
To help you quickly deploy the example application, please clone the guide assets from this [Github repository](https://github.com/Infisical/infisical-guides.git).
This repository contains assets for all Infisical guides. The content for this guide can be found within a sub directory called `aws-ecs-with-agent`.
The guide will assume that `aws-ecs-with-agent` is your working directory going forward.
## Deploy example application
Before we can deploy our full application and its related infrastructure with Terraform, we'll need to first configure our Infisical agent.
### Agent configuration overview
The agent config file defines what authentication method will be used when connecting with Infisical along with where the fetched secrets/access tokens should be saved to.
Since the Infisical agent will be deployed as a sidecar, the agent configuration file will need to be encoded in base64.
This encoding step is necessary as it allows the agent configuration file to be added into our Terraform configuration without needing to upload it first.
#### Full agent configuration file
Inside the `aws-ecs-with-agent` directory, you will find a sample `agent-config.yaml` file. This agent config file will connect with Infisical Cloud using AWS Auth and deposit access tokens at path `/infisical-agent/access-token` and render secrets to file `/infisical-agent/secrets`.
```yaml agent-config.yaml theme={"dark"}
infisical:
address: https://app.infisical.com
exit-after-auth: true
auth:
type: aws-iam
sinks:
- type: file
config:
path: /infisical-agent/access-token
templates:
- template-content: |
{{- with secret "202f04d7-e4cb-43d4-a292-e893712d61fc" "dev" "/" }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
destination-path: /infisical-agent/secrets
```
#### Secret template
The Infisical agent accepts one or more optional templates. If provided, the agent will fetch secrets using the set authentication method and format the fetched secrets according to the given template.
Typically, these templates are passed in to the agent configuration file via file reference using the `source-path` property but for simplicity we define them inline.
In the agent configuration above, the template defined will transform the secrets from Infisical project with the ID `202f04d7-e4cb-43d4-a292-e893712d61fc`, in the `dev` environment, and secrets located in the path `/`, into a `KEY=VALUE` format.
Remember to update the project id, environment slug and secret path to one
that exists within your Infisical project
## Configure app on terraform
Navigate to the `ecs.tf` file in your preferred code editor. In the container\_definitions section, assign the values to the `machine_identity_id` and `agent_config` properties.
The `agent_config` property expects the base64-encoded agent configuration file. In order to get this, we use the `base64encode` and `file` functions of HCL.
```hcl ecs.tf theme={"dark"}
...snip...
resource "aws_ecs_task_definition" "app" {
family = "cb-app-task"
execution_role_arn = aws_iam_role.ecs_task_execution_role.arn
task_role_arn = aws_iam_role.ecs_task_role.arn
network_mode = "awsvpc"
requires_compatibilities = ["FARGATE"]
cpu = 4096
memory = 8192
container_definitions = templatefile("./templates/ecs/cb_app.json.tpl", {
app_image = var.app_image
sidecar_image = var.sidecar_image
app_port = var.app_port
fargate_cpu = var.fargate_cpu
fargate_memory = var.fargate_memory
aws_region = var.aws_region
machine_identity_id = "5655f4f5-332b-45f9-af06-8f493edff36f"
agent_config = base64encode(file("../agent-config.yaml"))
})
volume {
name = "infisical-efs"
efs_volume_configuration {
file_system_id = aws_efs_file_system.infisical_efs.id
root_directory = "/"
}
}
}
...snip...
```
After these values have been set, they will be passed to the Infisical agent during startup through environment variables, as configured in the `infisical-sidecar` container below.
```terraform templates/ecs/cb_app.json.tpl theme={"dark"}
[
...snip...
{
"name": "infisical-sidecar",
"image": "${sidecar_image}",
"cpu": 1024,
"memory": 1024,
"networkMode": "bridge",
"command": ["agent"],
"essential": false,
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/agent",
"awslogs-region": "${aws_region}",
"awslogs-stream-prefix": "ecs"
}
},
"healthCheck": {
"command": ["CMD-SHELL", "agent", "--help"],
"interval": 30,
"timeout": 5,
"retries": 3,
"startPeriod": 0
},
"environment": [
{
"name": "INFISICAL_MACHINE_IDENTITY_ID",
"value": "${machine_identity_id}"
},
{
"name": "INFISICAL_AGENT_CONFIG_BASE64",
"value": "${agent_config}"
}
],
"mountPoints": [
{
"containerPath": "/infisical-agent",
"sourceVolume": "infisical-efs"
}
]
}
]
```
In the above container definition, you'll notice that that the Infisical agent has a `mountPoints` defined.
This mount point is referencing to the already configured EFS volume as shown below.
`containerPath` is set to `/infisical-agent` because that is that the folder we have instructed the agent to deposit the credentials to.
```hcl terraform/efs.tf theme={"dark"}
resource "aws_efs_file_system" "infisical_efs" {
tags = {
Name = "INFISICAL-ECS-EFS"
}
}
resource "aws_efs_mount_target" "mount" {
count = length(aws_subnet.private.*.id)
file_system_id = aws_efs_file_system.infisical_efs.id
subnet_id = aws_subnet.private[count.index].id
security_groups = [aws_security_group.efs_sg.id]
}
```
## Configure AWS credentials
Because we'll be deploying the example file browser application to AWS via Terraform, you will need to obtain a set of `AWS Access Key` and `Secret Key`.
Once you have generated these credentials, export them to your terminal.
1. Export the AWS Access Key ID:
```bash theme={"dark"}
export AWS_ACCESS_KEY_ID=
```
2. Export the AWS Secret Access Key:
```bash theme={"dark"}
export AWS_SECRET_ACCESS_KEY=
```
## Deploy terraform configuration
With the agent's sidecar configuration complete, we can now deploy our changes to AWS via Terraform.
1. Change your directory to `terraform`
```sh theme={"dark"}
cd terraform
```
2. Initialize Terraform
```
$ terraform init
```
3. Preview resources that will be created
```
$ terraform plan
```
4. Trigger resource creation
```bash theme={"dark"}
$ terraform apply
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
```
```bash theme={"dark"}
Apply complete! Resources: 1 added, 1 changed, 1 destroyed.
Outputs:
alb_hostname = "cb-load-balancer-1675475779.us-east-1.elb.amazonaws.com:8080"
```
Once the resources have been successfully deployed, Terraform will output the host address where the file browser application will be accessible.
It may take a few minutes for the application to become fully ready.
## Verify secrets/tokens in EFS volume
To verify that the agent is depositing access tokens and rendering secrets to the paths specified in the agent config, navigate to the web address from the previous step.
Once you visit the address, you'll be prompted to login. Enter the credentials shown below.
![file browser main login page]()
Since our EFS volume is mounted to the path of the file browser application, we should see the access token and rendered secret file we defined via the agent config file.
![file browswer dashbaord]()
As expected, two files are present: `access-token` and `secrets`.
The `access-token` file should hold a valid `Bearer` token, which can be used to make HTTP requests to Infisical.
The `secrets` file should contain secrets, formatted according to the specifications in our secret template file (presented in key=value format).
![file browser access token deposit]()
![file browser secrets render]()
# Infisical Agent
Source: https://infisical.com/docs/integrations/platforms/infisical-agent
This page describes how to manage secrets using Infisical Agent.
Infisical Agent is a client daemon that simplifies the adoption of Infisical by providing a more scalable and user-friendly approach for applications to interact with Infisical.
It eliminates the need to modify application logic by enabling clients to decide how they want their secrets rendered through the use of templates.
![agent diagram]()
## Key Features
* **Token lifecycle management**: Automatically authenticates with Infisical and deposits renewed access tokens at specified path for applications to consume
* **Templating**: Renders secrets and dynamic secret leases via user provided templates to desired formats for applications to consume
## Token Renewal
The Infisical agent can help manage the life cycle of access tokens. The token renewal process is split into two main components: a `Method`, which is the authentication process suitable for your current setup, and `Sinks`, which are the places where the agent deposits the new access token whenever it receives updates.
When the Infisical Agent is started, it will attempt to obtain a valid access token using the authentication method you have configured. If the agent is unable to fetch a valid token, the agent will keep trying, increasing the time between each attempt.
Once a access token is successfully fetched, the agent will make sure the access token stays valid, continuing to renew it before it expires.
Every time the agent successfully retrieves a new access token, it writes the new token to the Sinks you've configured.
Access tokens can be utilized with Infisical SDKs or directly in API requests
to retrieve secrets from Infisical
## Templating
The Infisical agent can help deliver formatted secrets to your application in a variety of environments. To achieve this, the agent will retrieve secrets from Infisical, format them using a specified template, and then save these formatted secrets to a designated file path.
Templating process is done through the use of Go language's [text/template feature](https://pkg.go.dev/text/template).You can refer to the available secret template functions [here](#available-secret-template-functions). Multiple template definitions can be set in the agent configuration file to generate a variety of formatted secret files.
When the agent is started and templates are defined in the agent configuration file, the agent will attempt to acquire a valid access token using the set authentication method outlined in the agent's configuration.
If this initial attempt is unsuccessful, the agent will momentarily pauses before continuing to make more attempts.
Once the agent successfully obtains a valid access token, the agent proceeds to fetch the secrets from Infisical using it.
It then formats these secrets using the user provided templates and writes the formatted data to configured file paths.
### Available secret template functions
The secret template functions is what you will use to fetch resources such as static secrets and dynamic secret leases from Infisical. Below is a list of the available secret template functions that you can use in your templates.
```bash theme={"dark"}
listSecrets "" "environment-slug" "" ""
```
```bash example-template-usage-1 theme={"dark"}
{{- with listSecrets "6553ccb2b7da580d7f6e7260" "dev" "/" `{"recursive": false, "expandSecretReferences": true}` }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
```bash example-template-usage-2 theme={"dark"}
{{- with listSecrets "da8056c8-01e2-4d24-b39f-cb4e004b8d44" "staging" "/" `{"recursive": true, "expandSecretReferences": true}` }}
{{- range . }}
{{- if eq .SecretPath "/"}}
{{ .Key }}={{ .Value }}
{{- else}}
{{ .SecretPath }}/{{ .Key }}={{ .Value }}
{{- end}}
{{- end }}
{{- end }}
```
**Function name**: `listSecrets`
**Description**: This function can be used to render the full list of secrets within a given project, environment and secret path.
An optional JSON argument is also available. It includes the properties `recursive`, which defaults to false, and `expandSecretReferences`, which defaults to true and expands the returned secrets.
**Returns**: A single secret object with the following keys `Key, WorkspaceId, Value, SecretPath, Type, ID, and Comment`
```bash theme={"dark"}
listSecretsByProjectSlug "" "environment-slug" "" ""
```
```bash example-template-usage-1 theme={"dark"}
{{- with listSecretsByProjectSlug "my-project" "dev" "/" `{"recursive": false, "expandSecretReferences": true}` }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
```bash example-template-usage-2 theme={"dark"}
{{- with listSecretsByProjectSlug "my-project" "staging" "/" `{"recursive": true, "expandSecretReferences": true}` }}
{{- range . }}
{{- if eq .SecretPath "/"}}
{{ .Key }}={{ .Value }}
{{- else}}
{{ .SecretPath }}/{{ .Key }}={{ .Value }}
{{- end}}
{{- end }}
{{- end }}
```
**Function name**: `listSecretsByProjectSlug`
**Description**: This function can be used to render the full list of secrets within a given project slug, environment and secret path.
An optional JSON argument is also available. It includes the properties `recursive`, which defaults to false, and `expandSecretReferences`, which defaults to true and expands the returned secrets.
**Returns**: A list of secret objects, each with the following keys `Key, WorkspaceId, Value, SecretPath, Type, ID, and Comment`
```bash theme={"dark"}
getSecretByName "" "" "" ""
```
```bash example-template-usage theme={"dark"}
{{ with getSecretByName "d821f21d-aa90-453b-8448-8c78c1160a0e" "dev" "/" "POSTHOG_HOST"}}
{{ if .Value }}
password = "{{ .Value }}"
{{ end }}
{{ end }}
```
**Function name**: `getSecretByName`
**Description**: This function can be used to render a single secret by it's name.
**Returns**: A list of secret objects with the following keys `Key, WorkspaceId, Value, Type, ID, and Comment`
```bash theme={"dark"}
dynamicSecret "" "" "" "" "" ""
```
```bash example-redis-dynamic-secret theme={"dark"}
{{ with dynamicSecret "aaa-o7en-s5qm" "dev" "/" "redis" "1m" }}
{{ .DB_USERNAME }}={{ .DB_PASSWORD }}
{{- end }}
```
```bash example-ssh-dynamic-secret theme={"dark"}
{{ with dynamicSecret "my-project" "dev" "/" "my-ssh-secret" "1h" "root,deploy" }}
{{ .PRIVATE_KEY }}
{{ .SIGNED_KEY }}
{{- end }}
```
**Function Name**: `dynamicSecret`
**Description**: This function can be used to render a dynamic secret lease credentials. The credentials are automatically renewed before they expire, ensuring that the rendered credentials are always up-to-date.
**Returns**: An object with keys corresponding to the dynamic secret lease credentials.
The `principals` argument is only applicable to SSH dynamic secrets, where it is **required**. It accepts a comma-separated list of principals for the SSH certificate. The requested principals must be in the allowed list configured on the dynamic secret.
Note that if you have multiple dynamic secret templates with identical configurations, only one lease will be created in Infisical for those templates, and the same lease will be written to your specified destination paths.
## Caching
The Infisical Agent supports clientside caching of Dynamic Secret leases. If the cache is enabled, the agent will persist the dynamic secret leases to the cache across restarts of the agent.
### Persistent Caching
The Agent currently only supports persistent caching. To utilize persistent caching, you must be within a Kubernetes environment. We recommend using the [Infisical Agent Injector](/docs/integrations/platforms/kubernetes-injector) to inject the agent into pods within your Kubernetes cluster on demand.
### Cache eviction
Cache eviction is the process of removing cached data from the cache. The Agent will automatically evict cached data when the cache is full during a garbage collection cycle which is triggered every 10 minutes.
The cache will also automatically evict cached data that has gone stale or is about to go stale. For dynamic resources (such as dynamic secret leases), there's a TTL (Time-to-Live) associated with each lease which is used to determine if the lease is stale or about to go stale.
If a stale dynamic secret lease is detected, it will be automatically evicted from the cache and replaced with a new up-to-date lease.
### Cache Configuration
Configuring the cache is done through the agent configuration file. The following fields are available to configure the cache:
The type of persistent caching to use. Currently only `kubernetes` is available, and will only work within Kubernetes environments.
The path to where your persistent cache will be stored.
Persistent caching is only supported within kubernetes environments at the moment. Please refer to the [Infisical Agent Injector](/docs/integrations/platforms/kubernetes-injector) documentation for more information on how to use persistent caching within Kubernetes environments.
```yaml example-agent-config-file.yaml theme={"dark"}
cache:
persistent:
type: "kubernetes"
path: "/home/infisical/cache"
service-account-token-path: "/var/run/secrets/kubernetes.io/serviceaccount/token"
```
## Retrying mechanism
The agent will automatically attempt to retry failed API requests such as authentication, secrets retrieval, dynamic secret lease provisioning, etc.
By default, the agent will retry up to 3 times with a base delay of 200ms and a maximum delay of 5s.
You can configure the retrying mechanism through the agent configuration file. The following fields are available to configure the retrying mechanism:
How many times to retry failed API requests such as authentication, secret retrieval, etc. Defaults to `3` retries.
The maximum delay between retries. Defaults to `5s` (5 seconds).
The base delay between retries. Defaults to `200ms` (200 milliseconds).
```yaml example-agent-config-file.yaml theme={"dark"}
infisical:
address: "https://app.infisical.com"
retry-strategy:
max-retries: 3
max-delay: "5s"
base-delay: "200ms"
# ... rest of the agent configuration file
```
## Agent configuration file
To set up the authentication method for token renewal and to define secret templates, the Infisical agent requires a YAML configuration file containing properties defined below.
While specifying an authentication method is mandatory to start the agent, configuring sinks and secret templates are optional.
| Field | Description |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `infisical.address` | The URL of the Infisical service. Default: `"https://app.infisical.com"`. |
| `infisical.exit-after-auth` | Whether to exit the agent after authentication and first secret render. Default: `"false"`. |
| `infisical.revoke-credentials-on-shutdown` | Whether to revoke all managed dynamic secret leases and identity access tokens on shutdown. Default: `"false"`. |
| `infisical.retry-strategy.max-retries` | How many times to retry failed API requests such as authentication, secret retrieval, etc. Defaults to `3` retries. |
| `infisical.retry-strategy.max-delay` | The maximum delay between retries. Defaults to `5s` (5 seconds). |
| `infisical.retry-strategy.base-delay` | The base delay between retries. Defaults to `200ms` (200 milliseconds). |
| `auth.type` | The type of authentication method used. Available options: `universal-auth`, `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, `aws-iam` |
| `auth.config.identity-id` | The file path where the machine identity id is stored
This field is required when using any of the following auth types: `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, or `aws-iam`. |
| `auth.config.service-account-token` | Path to the Kubernetes service account token to use (optional)
Default: `/var/run/secrets/kubernetes.io/serviceaccount/token` |
| `auth.config.service-account-key` | Path to your GCP service account key file. This field is required when using `gcp-iam` auth type.
Please note that the file should be in JSON format. |
| `auth.config.client-id` | The file path where the universal-auth client id is stored. |
| `auth.config.client-secret` | The file path where the universal-auth client secret is stored. |
| `auth.config.remove_client_secret_on_read` | This will instruct the agent to remove the client secret from disk. |
| `sinks[].type` | The type of sink in a list of sinks. Each item specifies a sink type. Currently, only `"file"` type is available. |
| `sinks[].config.path` | The file path where the access token should be stored for each sink in the list. |
| `cache.persistent.type` | The type of persistent caching to use. Currently only `kubernetes` is available, and will only work within Kubernetes environments. |
| `cache.persistent.path` | The path to where your persistent cache will be stored. |
| `cache.persistent.service-account-token-path` | The path to the Kubernetes service account token to use for encrypting the persistent cache. Required when using `kubernetes` cache type. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token` |
| `templates[].source-path` | The path to the template file that should be used to render secrets. |
| `templates[].template-content` | The inline secret template to be used for rendering the secrets. |
| `templates[].destination-path` | The path where the rendered secrets from the source template will be saved to. |
| `templates[].config.polling-interval` | How frequently to check for secret changes. Default: `5m` (5 minutes) (optional) |
| `templates[].config.execute.command` | The command to execute when secret change is detected (optional) |
| `templates[].config.execute.timeout` | How long in seconds to wait for command to execute before timing out (optional) |
## Authentication
The Infisical agent supports multiple authentication methods. Below are the available authentication methods, with their respective configurations.
The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical.
Path to the file containing the universal auth client ID.
Path to the file containing the universal auth client secret.
Instructs the agent to remove the client secret from disk after reading
it.
To create a universal auth machine identity, follow the step by step guide outlined [here](/docs/documentation/platform/identities/universal-auth).
Update the agent configuration file with the specified auth method, client ID, and client secret. In the snippet below you can see a sample configuration of the `auth` field when using the Universal Auth method.
```yaml example-auth-config.yaml theme={"dark"}
auth:
type: "universal-auth"
config:
client-id: "./client-id" # Path to the file containing the client ID
client-secret: "./client" # Path to the file containing the client secret
remove_client_secret_on_read: false # Optional field, instructs the agent to remove the client secret from disk after reading it
```
The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical.
Path to the file containing the machine identity ID.
Path to the Kubernetes service account token to use. Default:
`/var/run/secrets/kubernetes.io/serviceaccount/token`.
To create a Kubernetes machine identity, follow the step by step guide outlined [here](/docs/documentation/platform/identities/kubernetes-auth).
Update the agent configuration file with the specified auth method, identity ID, and service account token. In the snippet below you can see a sample configuration of the `auth` field when using the Kubernetes method.
```yaml example-auth-config.yaml theme={"dark"}
auth:
type: "kubernetes"
config:
identity-id: "./identity-id" # Path to the file containing the machine identity ID
service-account-token: "/var/run/secrets/kubernetes.io/serviceaccount/token" # Optional field, custom path to the Kubernetes service account token to use
```
The Native Azure method is used to authenticate with Infisical when running in an Azure environment.
Path to the file containing the machine identity ID.
To create an Azure machine identity, follow the step by step guide outlined [here](/docs/documentation/platform/identities/azure-auth).
Update the agent configuration file with the specified auth method and identity ID. In the snippet below you can see a sample configuration of the `auth` field when using the Azure method.
```yaml example-auth-config.yaml theme={"dark"}
auth:
type: "azure"
config:
identity-id: "./identity-id" # Path to the file containing the machine identity ID
```
The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment.
Path to the file containing the machine identity ID.
To create a GCP machine identity, follow the step by step guide outlined [here](/docs/documentation/platform/identities/gcp-auth).
Update the agent configuration file with the specified auth method and identity ID. In the snippet below you can see a sample configuration of the `auth` field when using the GCP ID Token method.
```yaml example-auth-config.yaml theme={"dark"}
auth:
type: "gcp-id-token"
config:
identity-id: "./identity-id" # Path to the file containing the machine identity ID
```
The GCP IAM method is used to authenticate with Infisical with a GCP service account key.
Path to the file containing the machine identity ID.
Path to your GCP service account key file.
To create a GCP machine identity, follow the step by step guide outlined [here](/docs/documentation/platform/identities/gcp-auth).
Update the agent configuration file with the specified auth method, identity ID, and service account key. In the snippet below you can see a sample configuration of the `auth` field when using the GCP IAM method.
```yaml example-auth-config.yaml theme={"dark"}
auth:
type: "gcp-iam"
config:
identity-id: "./identity-id" # Path to the file containing the machine identity ID
service-account-key: "./service-account-key.json" # Path to your GCP service account key file
```
The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc.
Path to the file containing the machine identity ID.
To create an AWS machine identity, follow the step by step guide outlined [here](/docs/documentation/platform/identities/aws-auth).
Update the agent configuration file with the specified auth method and identity ID. In the snippet below you can see a sample configuration of the `auth` field when using the AWS IAM method.
```yaml example-auth-config.yaml theme={"dark"}
auth:
type: "aws-iam"
config:
identity-id: "./identity-id" # Path to the file containing the machine identity ID
```
## Quick start Infisical Agent
To install the Infisical agent, you must first install the [Infisical CLI](/docs/cli/overview) in the desired environment where you'd like the agent to run. This is because the Infisical agent is a sub-command of the Infisical CLI.
Once you have the CLI installed, you will need to provision programmatic access for the agent via [Universal Auth](/docs/documentation/platform/identities/universal-auth). To obtain a **Client ID** and a **Client Secret**, follow the step by step guide outlined [here](/docs/documentation/platform/identities/universal-auth).
Next, create agent config file as shown below. The example agent configuration file defines the token authentication method, one sink location, and a secret template.
```yaml example-agent-config-file.yaml theme={"dark"}
infisical:
address: "https://app.infisical.com"
auth:
type: "universal-auth"
config:
client-id: "./client-id"
client-secret: "./client-secret"
remove_client_secret_on_read: false
sinks:
- type: "file"
config:
path: "/some/path/to/store/access-token/file-name"
templates:
- source-path: my-dot-ev-secret-template
destination-path: /some/path/.env
config:
polling-interval: 60s
execute:
timeout: 30
command: ./reload-app.sh
```
The secret template below will be used to render the secrets with the key and the value separated by `=` sign. You'll notice that a custom function named `listSecrets` is used to fetch the secrets.
This function takes the following arguments: `listSecrets "" "" ""`.
```text my-dot-ev-secret-template theme={"dark"}
{{- with listSecrets "6553ccb2b7da580d7f6e7260" "dev" "/" }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
After defining the agent configuration file, run the command below pointing to the path where the agent configuration file is located.
```bash theme={"dark"}
infisical agent --config example-agent-config-file.yaml
```
# Infisical Proxy
Source: https://infisical.com/docs/integrations/platforms/infisical-proxy
Learn how to use the Infisical Proxy to proxy requests to Infisical with built-in caching for high availability.
## Overview
Infisical Proxy is a client-side daemon that acts as an API proxy for Infisical, providing caching capabilities for high availability. Applications connect to the proxy instead of directly to Infisical, and the proxy handles request forwarding, response caching, and automatic cache refresh.
**Key features:**
* **API Proxy**: Forwards all requests to your Infisical instance transparently
* **Caching**: Caches secret responses in-memory with automatic refresh
* **High Availability**: Continues serving cached secrets even when Infisical is unreachable (optimistic eviction strategy)
* **Automatic Cache Invalidation**: Purges stale cache entries when secrets are mutated through the proxy
* **Token Validation**: Periodically validates access tokens and evicts entries for revoked tokens
* **TLS Support**: Supports TLS encryption for secure communication
The Infisical Proxy is ideal for scenarios where you need to reduce load on your Infisical instance, improve response times, or ensure secret availability during network disruptions.
## How It Works
```mermaid theme={"dark"}
%%{init: {'theme': 'base', 'themeVariables': { 'edgeLabelBackground':'#ffffff', 'lineColor': '#333'}}}%%
flowchart LR
A[Application] -->|Request| B[Infisical Proxy]
B -->|Cache Hit| A
B -->|Cache Miss| C[Infisical]
C -->|Response| B
B -->|Cache & Return| A
style A fill:#ECF26D,stroke:#333,color:#000
style B fill:#ECF26D,stroke:#333,color:#000
style C fill:#ECF26D,stroke:#333,color:#000
```
The Infisical Proxy sits between your applications and your Infisical instance, acting as a transparent intermediary. Applications make requests to the proxy using the same API endpoints they would use with Infisical directly, simply replace your Infisical host URL with the proxy's address. The proxy handles authentication headers transparently, forwarding them to Infisical as needed.
When a request arrives, the proxy first checks its in-memory cache for a matching response. Cache lookups are based on the request method, path, query parameters, and authentication token, ensuring that different users and query variations are cached separately. If a matching entry exists, the proxy returns the cached response immediately without contacting Infisical, significantly reducing latency and load on your Infisical instance.
For requests that aren't in the cache, the proxy forwards them to Infisical, waits for the response, and then stores the response in its cache before returning it to the application. This means the first request for any unique combination of parameters will have normal latency, but subsequent identical requests will be served from cache.
To keep cached data fresh, the proxy runs two background processes. The first periodically validates that cached access tokens are still valid by making test requests to Infisical. If a token has been revoked, all cache entries associated with that token are immediately evicted. The second process refreshes cached secrets on a configurable interval, re-fetching data from Infisical and updating the cache with the latest values. Both processes use an optimistic strategy: if Infisical is unreachable, the proxy continues serving cached data rather than evicting entries, ensuring your applications remain operational during outages.
## Install the Infisical Proxy
The Infisical Proxy is available through the Infisical CLI. Please refer to the [CLI installation documentation](/docs/cli/overview) for more information on how to install the Infisical CLI.
## Quick Start
Start the proxy with minimal configuration:
```bash theme={"dark"}
infisical proxy start \
--domain=https://app.infisical.com \
--listen-address=localhost:8081 \
--tls-enabled=false
```
Then configure your application to use `http://localhost:8081` as the Infisical host instead of `https://app.infisical.com`.
For production deployments, it is strongly recommended to enable TLS by providing `--tls-cert-file` and `--tls-key-file`, and setting `--tls-enabled` to `true`.
Event Subscriptions is a paid feature that is available under the Enterprise license.
Please contact [sales@infisical.com](mailto:sales@infisical.com).
To enable event subscriptions with a minimal configuration, you need to provide the client ID and client secret for the machine identity used to authenticate the Event Subscription connection to Infisical.
You can create a machine identity in the [Infisical Dashboard](https://app.infisical.com/settings/machine-identities) or using the [Infisical CLI](/docs/cli/commands/machine-identity).
Once you have the client ID and client secret, you can start the proxy with the following command:
```bash theme={"dark"}
infisical proxy start \
--domain=https://app.infisical.com \
--listen-address=localhost:8081 \
--tls-enabled=false \
--enable-event-subscriptions \
--client-id= \
--client-secret=
```
Then configure your application to use `http://localhost:8081` as the Infisical host instead of `https://app.infisical.com`.
For more information on event subscriptions, refer to the [Cache refreshing via Event Subscriptions](#cache-refreshing-via-event-subscriptions) section.
## Configuration
### Command Options
Domain of your Infisical instance (e.g., [https://app.infisical.com](https://app.infisical.com))
Address and port for the proxy to listen on, e.g. `localhost:8081`
Whether to enable TLS encryption for secure communication for the proxy. Defaults to `true`.
Note that all communication between the proxy and Infisical is always encrypted by default. If you are self-hosting your Infisical instance, ensure that your Infisical instance is configured to use TLS.
Path to the TLS certificate file to use for proxy TLS encryption. This field is required if `--tls-enabled` is `true`.
Path to the TLS private key file. This field is required if `--tls-enabled` is `true`.
The eviction strategy to use for cached secrets. Defaults to `optimistic`, and currently this is the only supported eviction strategy.
The eviction strategy is used to determine when to evict cached secrets from the cache.
* `optimistic` - Only evict cached secrets when the proxy is able to reach Infisical and verify that the underlying cached secret is stale.
How often to validate that access tokens are still valid. If a token is deemed to be invalid *(such as if it has been revoked or has expired)*, the proxy will evict all cached secrets that are associated with that token. Supports duration formats like `60s|5m|1h|1d|1w|1y`.
How often to refresh cached secrets from Infisical. Defaults to `1h`. Supports duration formats like `60s|5m|1h|1d|1w|1y`.
Enables real-time cache refresh via [Event Subscriptions](/docs/documentation/platform/event-subscriptions). When enabled, the proxy subscribes to secret mutation events from Infisical and automatically re-fetches affected cache entries when changes occur. Requires `--client-id` and `--client-secret` to be provided.
The Universal Auth client ID for the machine identity used to authenticate the SSE connection to Infisical. Required when `--enable-event-subscriptions` is `true`. Note that you can also set the client ID via the environment variable `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.
The Universal Auth client secret for the machine identity. Required when `--enable-event-subscriptions` is `true`. Note that you can also set the client secret via the environment variable `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.
How often to poll for secret changes when event subscriptions are unavailable. Defaults to `10m`. Supports duration formats like `60s|5m|1h|1d|1w|1y`.
# Caching Behavior
### What Gets Cached
The proxy selectively caches responses to optimize for the most common secret retrieval patterns.
Only `GET` requests to secret endpoints are cached. This includes the list and retrieve endpoints across both API versions (`/api/v3/secrets` and `/api/v4/secrets`), as well as their raw variants and any sub-paths.
These endpoints represent read operations where caching provides the most benefit: reducing latency for frequently accessed secrets and decreasing load on your Infisical instance.
All other requests pass through the proxy without caching. This includes mutation operations like creating, updating, or deleting secrets (`POST`, `PATCH`, `DELETE`), as well as requests to non-secret endpoints such as authentication, project management, or user operations.
These requests are forwarded directly to Infisical and their responses are returned to the application without being stored. This design ensures that write operations always reach Infisical immediately and that the cache only contains secret data that benefits from being cached.
### Request Uniqueness
Each cache entry is uniquely identified by a SHA-256 hash of the request's method, path, query parameters, and authentication token.
This ensures that different query combinations and users are cached separately.
The cache key is constructed as follows:
```
sha256(method + path + query + access_token)
```
### Automatic Cache Refresh
The proxy automatically refreshes cached secrets and validates cached access tokens to ensure the data in the cache remains fresh and valid.
#### Access Token Validation
The proxy periodically validates that cached access tokens are still valid, running every 5 minutes by default.
For each unique token in the cache, the proxy makes a test request to Infisical using one of that token's cached requests.
If Infisical returns `401 Unauthorized` or `403 Forbidden`, all cache entries associated with that token are immediately evicted.
**When the proxy is configured with the optimistic eviction strategy**:
If Infisical is unreachable during token validation (network errors or `5xx` responses), the proxy keeps cached entries intact rather than evicting them. This ensures that your applications remain operational even if Infisical is temporarily unavailable.
#### Static Secrets Refresh
The proxy automatically refreshes cached secrets to ensure data stays current, running every hour by default.
During each refresh cycle, the proxy identifies all cache entries that were last updated longer ago than the refresh interval, then re-fetches each one from Infisical.
Successful responses update the cached data with fresh values. Entries that return `401`, `403`, or `404` during refresh are evicted from the cache, as these indicate the token has lost access or the resource no longer exists.
**When the proxy is configured with the `optimistic` eviction strategy**:
If Infisical is unreachable during the refresh cycle (network errors or `5xx` responses), the proxy keeps cached entries intact rather than evicting them. This ensures that your applications remain operational even if Infisical is temporarily unavailable.
#### Cache refreshing via Event Subscriptions
Event Subscriptions is a paid feature that is available under the Enterprise license.
Please contact [sales@infisical.com](mailto:sales@infisical.com).
When `--enable-event-subscriptions` is enabled, the proxy opens a long-lived [Event Subscription](/docs/documentation/platform/event-subscriptions) connection to Infisical's Events API using Sever-sent events (SSE). This allows the proxy to receive real-time notifications when secrets change and immediately re-fetch the affected secrets to update its cache, rather than waiting for the next polling interval.
The proxy subscribes to the following events:
| Event | Description |
| ------------------------ | ------------------------------ |
| `secret:create` | A new secret is created |
| `secret:update` | An existing secret is modified |
| `secret:delete` | A secret is removed |
| `secret:import-mutation` | A secret changes via an import |
When any of these events are received, the proxy identifies the affected cache entries based on the event's project, environment, and secret path, then re-fetches those entries from Infisical to update the cache with fresh values.
The machine identity used for the SSE connection (configured via `--client-id` and `--client-secret`) must have access to **all projects** you intend to fetch secrets from through the proxy. Specifically, the identity needs the **Secret Events** permission on each project to subscribe to events. Refer to the [Event Subscriptions documentation](/docs/documentation/platform/event-subscriptions#permissions-setup) for instructions on configuring the required permissions.
**Fallback to Static Secrets Refresh:**
When the SSE connection is active, the proxy relies on real-time events to keep the cache up to date. If the SSE connection fails, the proxy automatically falls back to the static secrets refresh mechanism, periodically polling Infisical to re-fetch cached secrets based on the `--polling-fallback-interval`. The proxy will continue attempting to reconnect the SSE connection, and once re-established, polling stops and real-time event-based refresh resumes.
### Mutation-Based Cache Invalidation
When a mutation request is processed through the proxy (`POST`, `PATCH`, or `DELETE` requests), the proxy extracts the `projectId`, `environment`, and `secretPath` from the request body and purges all cache entries that match these criteria—regardless of which token was used to cache them.
This cross-token purging ensures that all users see consistent data after a secret is modified. The proxy also supports wildcard path matching, so a mutation to `/production/database` will invalidate cache entries for both exact path matches and recursive queries that included that path.
For immediate cache invalidation, perform secret mutations through the proxy rather than directly to Infisical. For optimal performance it's recommended to use the proxy for all API requests.
### Eviction Strategy
The eviction strategy is used to determine when to evict cached entries from the cache. Currently the Infisical Proxy only supports the `optimistic` eviction strategy.
#### Optimistic Eviction
* Keeps cached data when Infisical is unreachable (network errors, or `5xx` responses)
* Ensures high availability when your Infisical instance is unreachable
* Cache entries are only evicted on:
* Token invalidation (`401`/`403` response)
* Resource not found (`404` response)
* Explicit mutation through the proxy
* Proxy restart *(when the proxy is restarted, all cached entries are evicted because the cache is stored in memory)*
The `optimistic` eviction strategy prioritizes availability. Applications will continue receiving cached secrets even if Infisical is down, at the cost of potentially serving slightly stale data.
## TLS Configuration
By default, TLS is enabled. For production deployments, provide your TLS certificate and key:
```bash theme={"dark"}
infisical proxy start \
--domain=https://app.infisical.com \
--listen-address=0.0.0.0:8081 \
--tls-cert-file=/path/to/cert.pem \
--tls-key-file=/path/to/key.pem
```
To disable TLS (**not recommended for production**):
```bash theme={"dark"}
infisical proxy start \
--domain=https://app.infisical.com \
--listen-address=localhost:8081 \
--tls-enabled=false
```
## Examples
### Using the Proxy with SDKs
Configure your Infisical SDK to point to the proxy instead of Infisical directly:
#### Node.js
```javascript theme={"dark"}
import { InfisicalSDK } from '@infisical/sdk'
const client = new InfisicalSDK({
siteUrl: "http://localhost:8081", // Proxy address instead of Infisical
// ... other configuration options
});
```
#### Python SDK
```python theme={"dark"}
from infisical_sdk import InfisicalSDKClient
client = InfisicalSDKClient(host="http://localhost:8081") # Proxy address instead of Infisical
```
### Direct API Calls
```bash theme={"dark"}
# Instead of calling Infisical directly:
# curl https://app.infisical.com/api/v3/secrets/raw?...
# Call the proxy:
curl -G http://localhost:8081/api/v4/secrets \
-H "Authorization: Bearer " \
--data-urlencode "projectId=" \
--data-urlencode "environment=dev" \
--data-urlencode "secretPath=/" \
--data-urlencode "recursive=true"
```
## Security Considerations
### Cache Encryption
All cached secret data is encrypted at rest in memory using AES-256 with GCM authentication.
Secrets are only decrypted momentarily when serving a response to a client, and are otherwise stored in encrypted form.
The encryption key is randomly generated at proxy startup and persists only for the lifetime of the process, and restarting the proxy generates a new key and clears all cached data.
The encryption key itself is protected in memory, using multiple layers of memory protection techniques.
* **Memory locking via `mlock()`:** prevents the key from being swapped to disk
* **Memory protection via `mprotect()`:** guards against buffer overflows and unauthorized access
* **Secure allocation via `mmap()`:** ensures the memory region is allocated safely
* **In-memory encryption using XSalsa20-Poly1305:** protects the key even within RAM
### Network Security
Enable TLS in production to encrypt traffic between your applications and the proxy.
Without TLS, secrets are transmitted in plaintext over the network between your applications and the proxy.
### Access Control
Restrict network access to the proxy's listen address to prevent unauthorized clients from querying cached secrets.
The proxy should only be accessible to trusted applications within your infrastructure.
### Token Isolation
The proxy caches responses separately for each authentication token.
If a token is compromised, only the cache entries associated with that specific token are exposed. Other tokens' cached data remains isolated and protected.
## Troubleshooting
If you're updating secrets directly in Infisical (not through the proxy), the proxy will not automatically invalidate the cache. You will need to manually purge the cache by restarting the proxy, or by waiting for the next `static-secrets-refresh-interval` cycle.
The `static-secrets-refresh-interval` is the interval at which the proxy will refresh cached secrets from Infisical.
For immediate invalidation, perform mutations through the proxy.
# Kubernetes CSI
Source: https://infisical.com/docs/integrations/platforms/kubernetes-csi
How to use the Infisical Kubernetes CSI provider to inject secrets directly into Kubernetes pods.
## Overview
The Infisical CSI provider allows you to use Infisical with the [Secrets Store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io) to inject secrets directly into your Kubernetes pods through a volume mount.
In contrast to the [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes), the Infisical CSI provider will allow you to sync Infisical secrets directly to pods as files, removing the need for Kubernetes secret resources.
For a complete Helm chart reference including all configurable values, see the [CSI Provider Helm chart documentation](/docs/self-hosting/helm-charts/csi-provider).
```mermaid theme={"dark"}
flowchart LR
subgraph Secrets Management
SS(Infisical) --> CSP(Infisical CSI Provider)
CSP --> CSD(Secrets Store CSI Driver)
end
subgraph Pod
CSD --> V(Volume)
V <--> P(Application)
end
```
## Features
The following features are supported by the Infisical CSI Provider:
* Integration with Secrets Store CSI Driver for direct pod mounting
* Authentication using Kubernetes service accounts via machine identities
* Auto-syncing secrets when enabled via CSI Driver
* Configurable secret paths and file mounting locations
* Installation via Helm
## Prerequisites
The Infisical CSI provider is only supported for Kubernetes clusters with version >= 1.20.
## Limitations
Currently, the Infisical CSI provider only supports static secrets.
## Deploy to Kubernetes cluster
### Install Secrets Store CSI Driver
In order to use the Infisical CSI provider, you will first have to install the [Secrets Store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation) to your cluster.
#### Standard Installation
For most Kubernetes clusters, use the following installation:
```bash theme={"dark"}
helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
```
```bash theme={"dark"}
helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
--namespace=kube-system \
--set "tokenRequests[0].audience=infisical" \
--set enableSecretRotation=true \
--set rotationPollInterval=2m \
--set "syncSecret.enabled=true" \
```
The flags configure the following:
* `tokenRequests[0].audience=infisical`: Sets the audience value for service account token authentication (recommended for environments that support custom audiences)
* `enableSecretRotation=true`: Enables automatic secret updates from Infisical
* `rotationPollInterval=2m`: Checks for secret updates every 2 minutes
* `syncSecret.enabled=true`: Enables syncing secrets to Kubernetes secrets
If you do not wish to use the auto-syncing feature of the secrets store CSI
driver, you can omit the `enableSecretRotation` and the `rotationPollInterval`
flags. Do note that by default, secrets from Infisical are only fetched and
mounted during pod creation. If there are any changes made to the secrets in
Infisical, they will not propagate to the pods unless auto-syncing is enabled
for the CSI driver.
#### Installation for Environments Without Custom Audience Support
Some Kubernetes environments (such as AWS EKS) don't support custom audiences and will reject tokens with non-default audiences. For these environments, use this installation instead:
```bash theme={"dark"}
helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
--namespace=kube-system \
--set enableSecretRotation=true \
--set rotationPollInterval=2m \
--set "syncSecret.enabled=true" \
```
**Environments without custom audience support**: Do not set a custom audience
when installing the CSI driver in environments that reject custom audiences.
Instead, use the installation above and set `useDefaultAudience: "true"` in
your SecretProviderClass configuration.
### Install Infisical CSI Provider
You would then have to install the Infisical CSI provider to your cluster.
**Install the latest Infisical Helm repository**
```bash theme={"dark"}
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update
```
**Install the Helm Chart**
```bash theme={"dark"}
helm install infisical-csi-provider infisical-helm-charts/infisical-csi-provider
```
For a list of all supported arguments for the helm installation, you can run the following:
```bash theme={"dark"}
helm show values infisical-helm-charts/infisical-csi-provider
```
### Authentication
In order for the Infisical CSI provider to pull secrets from your Infisical project, you will have to configure
a machine identity with [Kubernetes authentication](https://infisical.com/docs/documentation/platform/identities/kubernetes-auth) configured with your cluster.
You can refer to the documentation for setting it up [here](https://infisical.com/docs/documentation/platform/identities/kubernetes-auth#guide).
**Important**: The "Allowed Audience" field in your machine identity's
Kubernetes authentication settings must match your CSI driver installation. If
you used the standard installation with `tokenRequests[0].audience=infisical`,
set the "Allowed Audience" field to `infisical`. If you used the installation
for environments without custom audience support, leave the "Allowed Audience"
field empty.
### Creating Secret Provider Class
With the Secrets Store CSI driver and the Infisical CSI provider installed, create a Kubernetes [SecretProviderClass](https://secrets-store-csi-driver.sigs.k8s.io/concepts.html#secretproviderclass) resource to establish
the connection between the CSI driver and the Infisical CSI provider for secret retrieval. You can create as many Secret Provider Classes as needed for your cluster.
#### Standard Configuration
```yaml theme={"dark"}
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
name: my-infisical-app-csi-provider
spec:
provider: infisical
parameters:
infisicalUrl: "https://app.infisical.com"
authMethod: "kubernetes"
identityId: "ad2f8c67-cbe2-417a-b5eb-1339776ec0b3"
projectId: "09eda1f8-85a3-47a9-8a6f-e27f133b2a36"
envSlug: "prod"
secrets: |
- secretPath: "/"
fileName: "dbPassword"
secretKey: "DB_PASSWORD"
- secretPath: "/app"
fileName: "appSecret"
secretKey: "APP_SECRET"
```
#### Configuration for Environments Without Custom Audience Support
For environments that don't support custom audiences (such as AWS EKS), use this configuration instead:
```yaml theme={"dark"}
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
name: my-infisical-app-csi-provider
spec:
provider: infisical
parameters:
infisicalUrl: "https://app.infisical.com"
authMethod: "kubernetes"
useDefaultAudience: "true"
identityId: "ad2f8c67-cbe2-417a-b5eb-1339776ec0b3"
projectId: "09eda1f8-85a3-47a9-8a6f-e27f133b2a36"
envSlug: "prod"
secrets: |
- secretPath: "/"
fileName: "dbPassword"
secretKey: "DB_PASSWORD"
- secretPath: "/app"
fileName: "appSecret"
secretKey: "APP_SECRET"
```
**Key difference**: The only change from the standard configuration is the
addition of `useDefaultAudience: "true"`. This parameter tells the CSI
provider to use the default Kubernetes audience instead of a custom
"infisical" audience, which is required for environments that reject custom
audiences.
The SecretProviderClass should be provisioned in the same namespace as the pod
you intend to mount secrets to.
#### Supported Parameters
The base URL of your Infisical instance. If you're using Infisical Cloud US,
this should be set to `https://app.infisical.com`. If you're using Infisical
Cloud EU, then this should be set to `https://eu.infisical.com`.
The CA certificate of the Infisical instance in order to establish SSL/TLS
when the instance uses a private or self-signed certificate. Unless necessary,
this should be omitted.
The auth method to use for authenticating the Infisical CSI provider with
Infisical. For now, the only supported method is `kubernetes`.
The ID of the machine identity to use for authenticating the Infisical CSI
provider with your Infisical organization. This should be the machine identity
configured with Kubernetes authentication.
The project ID of the Infisical project to pull secrets from.
The slug of the project environment to pull secrets from.
An array that defines which secrets to retrieve and how to mount them. Each
entry requires three properties: `secretPath` and `secretKey` work together to
identify the source secret to fetch, while `fileName` specifies the path where
the secret's value will be mounted within the pod's filesystem.
The custom audience value configured for the CSI driver. This defaults to
`infisical`.
When set to `"true"`, the Infisical CSI provider will use the default
Kubernetes audience instead of a custom audience. This is required for
environments that don't support custom audiences (such as AWS EKS), which
reject tokens with non-default audiences. When using this option, do not set a
custom audience in the CSI driver installation. This defaults to `false`.
When enabled, the CSI provider will dynamically create service account
tokens on-demand using the default Kubernetes audience, rather than using
pre-existing tokens from the CSI driver.
### Using Secret Provider Class
A pod can use the Secret Provider Class by mounting it as a CSI volume:
```yaml theme={"dark"}
apiVersion: v1
kind: Pod
metadata:
name: nginx-secrets-store
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: secrets-store-inline
mountPath: "/mnt/secrets-store"
readOnly: true
volumes:
- name: secrets-store-inline
csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: "my-infisical-app-csi-provider"
```
When the pod is created, the secrets are mounted as individual files in the /mnt/secrets-store directory.
### Verifying Secret Mounts
To verify your secrets are mounted correctly:
```bash theme={"dark"}
# Check pod status
kubectl get pod nginx-secrets-store
# View mounted secrets
kubectl exec -it nginx-secrets-store -- ls -l /mnt/secrets-store
```
### Troubleshooting
To troubleshoot issues with the Infisical CSI provider, refer to the logs of the Infisical CSI provider running on the same node as your pod.
```bash theme={"dark"}
kubectl logs infisical-csi-provider-7x44t
```
You can also refer to the logs of the secrets store CSI driver. Modify the command below with the appropriate pod and namespace of your secrets store CSI driver installation.
```bash theme={"dark"}
kubectl logs csi-secrets-store-csi-driver-7h4jp -n=kube-system
```
**Common issues include:**
* Mismatch in the audience value of the CSI driver with the machine identity's Kubernetes auth configuration
* SecretProviderClass in the wrong namespace
* Invalid machine identity configuration
* Incorrect secret paths or keys
**Issues in environments without custom audience support:**
* **Token authentication failed with custom audience**: If you're seeing authentication errors in environments that don't support custom audiences (such as AWS EKS), ensure you're using the installation without custom audience and have set `useDefaultAudience: "true"` in your SecretProviderClass
* **Audience not allowed errors**: Make sure the "Allowed Audience" field is left empty in your machine identity's Kubernetes authentication configuration when using environments that don't support custom audiences
## Best Practices
For additional guidance on setting this up for your production cluster, you can refer to the Secrets Store CSI driver documentation [here](https://secrets-store-csi-driver.sigs.k8s.io/topics/best-practices).
## Frequently Asked Questions
Yes, but it requires an indirect approach:
1. First enable syncing to Kubernetes secrets by setting `syncSecret.enabled=true` in the CSI driver installation
2. Configure the Secret Provider Class to sync specific secrets to Kubernetes secrets
3. Use the resulting Kubernetes secrets in your pod's environment variables
This means secrets are first synced to Kubernetes secrets before they can be used as environment variables. You can find detailed examples in the [Secrets Store CSI driver documentation](https://secrets-store-csi-driver.sigs.k8s.io/topics/set-as-env-var).
Yes, you will need to explicitly list each secret you want to sync in the
Secret Provider Class configuration. This is a common requirement across all
CSI providers as the Secrets Store CSI Driver architecture requires specific
mapping of secrets to their mounted file locations.
# Kubernetes Agent Injector
Source: https://infisical.com/docs/integrations/platforms/kubernetes-injector
How to use the Infisical Kubernetes Agent Injector to inject secrets directly into Kubernetes pods.
## Overview
The Infisical Kubernetes Agent Injector allows you to inject secrets directly into your Kubernetes pods. The Injector will create a [Infisical Agent](/docs/integrations/platforms/infisical-agent) container within your pod that syncs secrets from Infisical into a shared volume mount within your pod.
For a complete Helm chart reference including all configurable values, see the [Agent Injector Helm chart documentation](/docs/self-hosting/helm-charts/agent-injector).
The Infisical Agent Injector will patch and modify your pod's deployment to contain an [Infisical Agent](/docs/integrations/platforms/infisical-agent) container which renders your Infisical secrets into a shared volume mount within your pod.
The Infisical Agent Injector is built on [Kubernetes Mutating Admission Webhooks](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers), and will watch for `CREATE` and `UPDATE` events on pods in your cluster.
The injector is namespace-agnostic, and will watch for pods in any namespace, but will only patch pods that have the `org.infisical.com/inject` annotation set to `true`.
```mermaid theme={"dark"}
flowchart LR
subgraph Secrets Management
SS(Infisical) --> INJ(Infisical Injector)
end
subgraph Pod
INJ --> INIT(Agent Init Container)
INIT --> V(Volume)
V <--> P(Application)
end
```
## Install the Infisical Agent Injector
To install the Infisical Agent Injector, you will need to install our helm charts using [Helm](https://helm.sh/).
```bash theme={"dark"}
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update
helm install --generate-name infisical-helm-charts/infisical-agent-injector
```
After installing the helm chart you can verify that the injector is running and working as intended by checking the logs of the injector pod.
```bash theme={"dark"}
$ kubectl logs deployment/infisical-agent-injector
2025/05/19 14:20:05 Starting infisical-agent-injector...
2025/05/19 14:20:05 Generating self-signed certificate...
2025/05/19 14:20:06 Creating directory: /tmp/tls
2025/05/19 14:20:06 Writing cert to: /tmp/tls/tls.crt
2025/05/19 14:20:06 Writing key to: /tmp/tls/tls.key
2025/05/19 14:20:06 Starting HTTPS server on port 8585...
2025/05/19 14:20:06 Attempting to update webhook config (attempt 1)...
2025/05/19 14:20:06 Successfully updated webhook configuration with CA bundle
```
## Windows support
By default the agent injector is built for Linux-based pods, but supports injecting into Windows-based pods.
**To inject into Windows-based pods, no extra configuration is needed.** The agent injector will automatically detect and handle injections into Windows-based pods.
However, if you are trying to run the agent injector itself on a Windows-based pod, you'll need to configure your helm values.yaml file to point to a Windows-based image.
The Agent Injector will only run on and inject into Windows-based pods that are running on the supported Windows versions:
* **Windows Server 2022**
* **Windows Server 2019**
We're looking to add support for other Windows versions in the future. If you're using a different Windows version, please let us know by opening [an issue](https://github.com/Infisical/infisical-agent-injector/issues/new), and we'll look into adding support for your desired version as soon as possible.
You will need to set the `nodeSelector.kubernetes.io/os` label to `windows` and set the image tag to a Windows-based image. Below are two examples for Windows Server 2019 and Windows Server 2022.
Create your `values.yaml` file and add the following:
```yaml values.yaml theme={"dark"}
image:
repository: infisical/infisical-agent-injector
tag: "v0.1.4-windows-server-2019"
nodeSelector:
kubernetes.io/os: windows
```
Install the agent injector using the values.yaml file you created above.
```bash theme={"dark"}
helm install --generate-name infisical-helm-charts/infisical-agent-injector -f values.yaml
```
Create your `values.yaml` file and add the following:
```yaml values.yaml theme={"dark"}
image:
repository: infisical/infisical-agent-injector
tag: "v0.1.4-windows-server-2022"
nodeSelector:
kubernetes.io/os: windows
```
Install the agent injector using the values.yaml file you created above.
```bash theme={"dark"}
helm install --generate-name infisical-helm-charts/infisical-agent-injector -f values.yaml
```
Note that Windows support is only supported in version `v0.1.4` and above. If you are using an older version, you will need to upgrade to `v0.1.4` or above to use Windows support.
## Supported annotations
The Infisical Agent Injector supports the following annotations:
The inject annotation is used to enable the injector on a pod. Set the value to `true` and the pod will be patched with an Infisical Agent container on update or create.
The inject mode annotation is used to specify the mode to use to inject the secrets into the pod.
* `init`: The init method will create an init container for the pod that will render the secrets into a shared volume mount within the pod. The agent init container will run before any other containers in the pod runs, including other init containers.
* `sidecar`: The sidecar method will create a sidecar container for the pod that will render the secrets into a shared volume mount within the pod. The agent sidecar container will run alongside the main container in the pod. This means that the secrets rendered will always be in sync with your Infisical secrets.
* `sidecar-init`: The sidecar-init method will create the init container and the sidecar container from the other two methods. The init container will run before any other container and fetch the secrets from the start and the sidecar container will keep the secrets in sync throughout the lifecycle of the deployment.
The agent config map annotation is used to specify the name of the config map that contains the configuration for the injector. The config map must be in the same namespace as the pod.
Whether to enable client-side caching of dynamic secret leases. Defaults to `false`. If you set this to `true`, the agent will persist any dynamic secret leases across restarts of the agent. This is especially useful when using the `sidecar-init` inject mode, to pass the dynamic secret leases created in the init container to the sidecar container.
This will ensure that no new leases are created except those initially created in the init container. The sidecar container will register the leases created in the init container and start managing them from that point onwards.
Specify a custom agent image to use for the agent sidecar / init container(s). Example: `infisical/cli:0.43.32`.
If not specified, the most recent stable version of the Infisical Agent will be used.
Whether to revoke all managed dynamic secret leases and machine identity access tokens on shutdown. Defaults to `false`.
If you set this to `true`, all managed dynamic secret leases and machine identity access tokens will be revoked when a `SIGTERM` signal is sent to the agents container *(such as when a pod is terminated or when the pod is restarted)*.
**Note:** In disaster events such as cluster power outages, a `SIGTERM` signal won't be sent to the agents container, and the credentials will not be revoked.
How many times to retry failed API requests such as authentication, secret retrieval, etc. Defaults to `3` retries. Refer to the [Retrying mechanism](/docs/integrations/platforms/infisical-agent#retrying-mechanism) documentation for more information on how to configure the retry strategy.
The maximum delay between retries. Defaults to `5s` (5 seconds). Refer to the [Retrying mechanism](/docs/integrations/platforms/infisical-agent#retrying-mechanism) documentation for more information on how to configure the retry strategy.
The base delay between retries. Defaults to `200ms` (200 milliseconds). Refer to the [Retrying mechanism](/docs/integrations/platforms/infisical-agent#retrying-mechanism) documentation for more information on how to configure the retry strategy.
The maximum CPU limit for the agent containers.
Linux Pods: Defaults to `500m` (500 milliCPUs).
Windows Pods: Defaults to `500m` (500 milliCPUs).
The minimum CPU request for the agent containers.
Linux Pods: Defaults to `100m` (100 milliCPUs).
Windows Pods: Defaults to `100m` (100 milliCPUs).
The maximum memory limit for the agent containers.
Linux Pods: Defaults to `128Mi` (128 megabytes).
Windows Pods: Defaults to `512Mi` (512 megabytes).
The minimum memory request for the agent containers.
Linux Pods: Defaults to `64Mi` (64 megabytes).
Windows Pods: Defaults to `256Mi` (256 megabytes).
The maximum ephemeral storage limit for the agent containers. Doesn't have an explicit default value. The default value will conform to the default ephemeral storage limit for the pod.
The minimum ephemeral storage request for the agent containers. Doesn't have an explicit default value. The default value will conform to the default ephemeral storage request for the pod.
Whether to set a security context on the injected agent containers. Defaults to `false`.
When set to `true`, the agent containers will be configured with a hardened security context. The default security context applied is:
```yaml theme={"dark"}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 2000
runAsNonRoot: true
runAsUser: 1000
```
You can customize individual security context settings using the other `agent-security-context-*` annotations.
The user ID to run the agent containers as. Defaults to `1000`.
If set to `0`, `runAsNonRoot` will automatically be set to `false` to allow the container to run as root.
This annotation is only applicable when `org.infisical.com/agent-set-security-context` is set to `true`.
The group ID to run the agent containers as. Defaults to `2000`.
If set to `0`, `runAsNonRoot` will automatically be set to `false` to allow the container to run as the root group.
This annotation is only applicable when `org.infisical.com/agent-set-security-context` is set to `true`.
Whether to mount the root filesystem as read-only. Defaults to `true`.
This setting only applies to Linux-based pods.
Windows containers do not support read-only root filesystems.
This annotation is only applicable when `org.infisical.com/agent-set-security-context` is set to `true`.
Whether to run the agent containers in privileged mode. Defaults to `false`.
Running containers in privileged mode grants full access to the host and should only be used when absolutely necessary.
This annotation is only applicable when `org.infisical.com/agent-set-security-context` is set to `true`.
Whether to allow privilege escalation for the agent containers. Defaults to `false`.
When set to `false`, the container cannot gain more privileges than its parent process. This is a recommended security hardening measure.
This annotation is only applicable when `org.infisical.com/agent-set-security-context` is set to `true`.
## ConfigMap Configuration
### Supported Fields
When you are configuring a pod to use the injector, you must create a config map in the same namespace as the pod you want to inject secrets into.
The entire config needs to be of string format and needs to be assigned to the `config.yaml` key in the config map. You can find a full example of the config at the end of this section.
The address of your Infisical instance. This field is optional and will default to `https://app.infisical.com` if not provided.
Whether to revoke all managed dynamic secret leases and machine identity access tokens on shutdown. Default: `"false"`.
If this is set to `true`, all managed dynamic secret leases and machine identity access tokens will be revoked when a `SIGTERM` signal is sent to the agents container *(such as when a pod is terminated or when the pod is restarted)*.
**Note:** In disaster events such as cluster power outages, a `SIGTERM` signal won't be sent to the agents container, and the credentials will not be revoked.
This is currently unsupported on Windows-based pods, and will only work when injecting into Linux-based pods.
It's recommended to use the annotation `org.infisical.com/agent-revoke-on-shutdown: "true"` instead of configuring the revoke on shutdown on the config map. Refer to the [Supported annotations](/docs/integrations/platforms/kubernetes-injector#supported-annotations) documentation for more information on how to configure the revoke on shutdown through annotations.
The authentication type to use to connect to Infisical. Supported types: `kubernetes`, `ldap-auth`, and `aws-iam`.
* For `kubernetes`: The pod's default service account will be used to authenticate with Infisical. See [Kubernetes Auth](/docs/documentation/platform/identities/kubernetes-auth).
* For `ldap-auth`: LDAP credentials are used. See [LDAP Auth](/docs/documentation/platform/identities/ldap-auth).
* For `aws-iam`: The pod's AWS credential chain (IRSA or instance profile) is used to authenticate. See [AWS Auth](/docs/documentation/platform/identities/aws-auth).
The ID of the machine identity to use for authentication. This field is required when `infisical.auth.type` is set to `kubernetes`, `ldap-auth`, or `aws-iam`.
The LDAP username to use for LDAP authentication.
This field is required if the `infisical.auth.type` is set to `ldap-auth`.
The LDAP password to use for LDAP authentication.
This field is required if the `infisical.auth.type` is set to `ldap-auth`.
How many times to retry failed API requests such as authentication, secret retrieval, etc. Defaults to `3` retries. Refer to the [Retrying mechanism](/docs/integrations/platforms/infisical-agent#retrying-mechanism) documentation for more information on how to configure the retry strategy.
You can also configure the max retries through annotations. Refer to the [Supported annotations](/docs/integrations/platforms/kubernetes-injector#supported-annotations) documentation for more information on how to configure the max retries through annotations.
The maximum delay between retries. Defaults to `5s` (5 seconds). Refer to the [Retrying mechanism](/docs/integrations/platforms/infisical-agent#retrying-mechanism) documentation for more information on how to configure the retry strategy.
You can also configure the max delay through annotations. Refer to the [Supported annotations](/docs/integrations/platforms/kubernetes-injector#supported-annotations) documentation for more information on how to configure the max delay through annotations.
The base delay between retries. Defaults to `200ms` (200 milliseconds). Refer to the [Retrying mechanism](/docs/integrations/platforms/infisical-agent#retrying-mechanism) documentation for more information on how to configure the retry strategy.
You can also configure the base delay through annotations. Refer to the [Supported annotations](/docs/integrations/platforms/kubernetes-injector#supported-annotations) documentation for more information on how to configure the base delay through annotations.
The type of persistent caching to use. Currently only `kubernetes` is available, and will only work within Kubernetes environments.
It is recommended to use the annotation `org.infisical.com/agent-cache-enabled: "true"` instead of configuring the cache on the config map. Refer to the [Supported annotations](/docs/integrations/platforms/kubernetes-injector#supported-annotations) documentation for more information on how to configure the cache through annotations.
The path to the Kubernetes service account token to use for encrypting the persistent cache. Required when using `kubernetes` cache type. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
It is recommended to use the annotation `org.infisical.com/agent-cache-enabled: "true"` instead of configuring the cache on the config map. Refer to the [Supported annotations](/docs/integrations/platforms/kubernetes-injector#supported-annotations) documentation for more information on how to configure the cache through annotations.
The templates hold an array of templates that will be rendered and injected into the pod.
The path to inject the secrets into within the pod.
If not specified, this will default to `/shared/infisical-secrets`. If you have multiple templates and don't provide a destination path, the destination paths will default to `/shared/infisical-secrets-1`, `/shared/infisical-secrets-2`, etc.
The content of the template to render.
This will be rendered as a [Go Template](https://pkg.go.dev/text/template) and will have access to the following variables.
It follows the templating format and supports the same functions as the [Infisical Agent](/docs/integrations/platforms/infisical-agent#quick-start-infisical-agent)
### Authentication
The Infisical Agent Injector supports Machine Identity [Kubernetes Auth](/docs/documentation/platform/identities/kubernetes-auth), [LDAP Auth](/docs/documentation/platform/identities/ldap-auth), and [AWS Auth](/docs/documentation/platform/identities/aws-auth) authentication.
To configure Kubernetes Auth, you need to set the `auth.type` field to `kubernetes` and set the `auth.config.identity-id` to the ID of the machine identity you wish to use for authentication.
```yaml theme={"dark"}
auth:
type: "kubernetes"
config:
identity-id: ""
```
### Example ConfigMap
```yaml config-map.yaml theme={"dark"}
apiVersion: v1
kind: ConfigMap
metadata:
name: demo-config-map
data:
config.yaml: |
infisical:
address: "https://app.infisical.com"
auth:
type: "kubernetes"
config:
identity-id: ""
templates:
- destination-path: "/path/to/save/secrets/file.txt"
template-content: |
{{- with secret "" "dev" "/" }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
```bash theme={"dark"}
kubectl apply -f config-map.yaml
```
To configure LDAP Auth, you need to set the `auth.type` field to `ldap-auth` and set the `auth.config.identity-id` to the ID of the machine identity you wish to use for authentication. Configure the `auth.config.username` and `auth.config.password` to the username and password of the LDAP user to authenticate with.
```yaml theme={"dark"}
auth:
type: "ldap-auth"
config:
identity-id: ""
username: ""
password: ""
```
### Example ConfigMap
```yaml config-map.yaml theme={"dark"}
apiVersion: v1
kind: ConfigMap
metadata:
name: demo-config-map
data:
config.yaml: |
infisical:
address: "https://app.infisical.com"
auth:
type: "ldap-auth"
config:
identity-id: ""
username: ""
password: ""
templates:
- destination-path: "/path/to/save/secrets/file.txt"
template-content: |
{{- with secret "" "dev" "/" }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
```bash theme={"dark"}
kubectl apply -f config-map.yaml
```
To configure AWS IAM Auth, you need to set the `auth.type` field to `aws-iam` and set the `auth.config.identity-id` to the ID of the machine identity you wish to use for authentication. The pod must run in an AWS environment (e.g., EKS with IRSA or EC2 with instance profile) so that the agent can use the pod's ambient AWS credential chain to authenticate with Infisical.
```yaml theme={"dark"}
auth:
type: "aws-iam"
config:
identity-id: ""
```
### Example ConfigMap
```yaml config-map.yaml theme={"dark"}
apiVersion: v1
kind: ConfigMap
metadata:
name: demo-config-map
data:
config.yaml: |
infisical:
address: "https://app.infisical.com"
auth:
type: "aws-iam"
config:
identity-id: ""
templates:
- destination-path: "/path/to/save/secrets/file.txt"
template-content: |
{{- with secret "" "dev" "/" }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
```bash theme={"dark"}
kubectl apply -f config-map.yaml
```
To use the config map in your pod, you will need to add the `org.infisical.com/agent-config-map` annotation to your pod's deployment. The value of the annotation is the name of the config map you created above. The config map must be in the same namespace as the pod you're injecting into.
```yaml theme={"dark"}
apiVersion: v1
kind: Pod
metadata:
name: demo
labels:
app: demo
annotations:
org.infisical.com/inject: "true" # Set to true for the injector to patch the pod on create/update events
org.infisical.com/inject-mode: "init" # The mode to use to inject the secrets into the pod. init|sidecar
org.infisical.com/agent-config-map: "name-of-config-map" # The name of the config map that you created above, which contains all the settings for injecting the secrets into the pod
spec:
# ...
```
## Quick Start
In this section we'll walk through a full example of how to inject secrets into a pod using the Infisical Agent Injector.
In this example we'll create a basic nginx deployment and print a Infisical secret called `API_KEY` to the container logs.
### Create secrets in Infisical
First you'll need to create the secret in Infisical.
* `API_KEY`: The API key to use for the nginx deployment.
Once you've created the secret, save your project ID, environment slug, and secret path, as these will be used in the next step.
### Configuration
To use the injector you must create a config map in the same namespace as the pod you want to inject secrets into. In this example we'll create a config map in the `test-namespace` namespace.
The agent injector will authenticate with Infisical using a [Kubernetes Auth](/docs/documentation/platform/identities/kubernetes-auth) machine identity. Please follow the [instructions](/docs/documentation/platform/identities/kubernetes-auth) to create a machine identity configured for Kubernetes Auth.
The agent injector will use the service account token of the pod to authenticate with Infisical.
The `template-content` will be rendered as a [Go Template](https://pkg.go.dev/text/template) and will have access to the following variables. It follows the templating format and supports the same functions as the [Infisical Agent](/docs/integrations/platforms/infisical-agent#quick-start-infisical-agent)
The `destination-path` refers to the path within the pod that the secrets will be injected into. In this case we're injecting the secrets into a file called `/infisical/secrets`.
Replace the ``, ``, with your project ID and the environment slug of where you created your secrets in Infisical. Replace `` with the ID of your machine identity configured for Kubernetes Auth.
```yaml config-map.yaml theme={"dark"}
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-infisical-config-map
namespace: test-namespace
data:
config.yaml: |
infisical:
address: "https://app.infisical.com"
auth:
type: "kubernetes"
config:
identity-id: ""
templates:
- destination-path: "/infisical/secrets"
template-content: |
{{- with secret "" "" "/" }}
{{- range . }}
{{ .Key }}={{ .Value }}
{{- end }}
{{- end }}
```
Now apply the config map:
```bash theme={"dark"}
kubectl apply -f config-map.yaml
```
### Injecting secrets into your pod
To inject secrets into your pod, you will need to add the `org.infisical.com/inject: "true"` annotation to your pod's deployment.
The `org.infisical.com/agent-config-map` annotation will point to the config map we created in the previous step. It's important that the config map is in the same namespace as the pod.
We are creating a nginx deployment with a PVC to store the database data.
```yaml nginx.yaml theme={"dark"}
---
apiVersion: v1
kind: Pod
metadata:
name: nginx-pod
namespace: test-namespace
labels:
app: nginx
annotations:
org.infisical.com/inject: "true"
org.infisical.com/inject-mode: "init"
org.infisical.com/agent-config-map: "nginx-infisical-config-map"
spec:
containers:
- name: simple-app-demo
image: nginx:alpine
command: ["/bin/sh", "-c"]
args:
- |
export $(cat /infisical/secrets | xargs)
echo "API_KEY is set to: $API_KEY"
nginx -g "daemon off;"
```
### Applying the deployment
To apply the deployment, you can use the following command:
```bash theme={"dark"}
kubectl apply -f nginx.yaml
```
It may take a few minutes for the pod to be ready and for the Infisical secrets to be injected. You can check the status of the pod by running:
```bash theme={"dark"}
kubectl get pods -n test-namespace
```
### Verifying the secrets are injected
To verify the secrets are injected, you can check the pod's logs:
```bash theme={"dark"}
$ kubectl exec -it pod/nginx-pod -n test-namespace -- cat /infisical/secrets
Defaulted container "simple-app-demo" out of: simple-app-demo, infisical-agent-init (init)
API_KEY=sk_api_... # The secret you created in Infisical
```
Additionally you can now check that the `API_KEY` secret is being logged to the nginx container logs:
```bash theme={"dark"}
$ kubectl logs pod/nginx-pod -n test-namespace
Defaulted container "simple-app-demo" out of: simple-app-demo, infisical-agent-init (init)
API_KEY is set to: sk_api_... # The secret you created in Infisical
```
## Troubleshooting
If the pod is stuck in `Init` state, it means the Agent init container is failing to start or is stuck in a restart loop.
This could be due to a number of reasons, such as the machine identity not having the correct permissions, or trying to fetch secrets from a non-existent project/environment.
You can check the logs of the infisical init container by running:
```bash theme={"dark"}
# For deployments
kubectl logs deployment/your-deployment-name -c infisical-agent-init -n ""
# For pods
kubectl logs pod/your-pod-name -c infisical-agent-init -n ""
```
You can also check the logs of the pod by running:
```bash theme={"dark"}
kubectl logs deployment/postgres-deployment -n test-namespace
```
When checking the logs of the agent init container, you may see something like the following:
```bash theme={"dark"}
Starting infisical agent...
11:10AM INF starting Infisical agent...
11:10AM INF Infisical instance address set to https://daniel1.tunn.dev
11:10AM INF template engine started for template 1...
11:10AM INF attempting to authenticate...
11:10AM INF new access token saved to file at path '/home/infisical/config/identity-access-token'
11:10AM ERR unable to process template because template: literalTemplate:1:9: executing "literalTemplate" at : error calling secret: CallGetRawSecretsV3: Unsuccessful response [GET https://daniel1.tunn.dev/api/v3/secrets/raw?environment=dev&expandSecretReferences=true&include_imports=true&secretPath=%2F&workspaceId=3c0d3ff6-165c-4dc9-b52c-ff3ffaedfce311111] [status-code=404] [response={"reqId":"req-ljqNq567jchFrK","statusCode":404,"message":"Project with ID '3c0d3ff6-165c-4dc9-b52c-ff3ffaedfce311111' not found during bot lookup. Are you sure you are using the correct project ID?","error":"NotFound"}]
+ echo 'Agent failed with exit code 1'
+ exit 1
Agent failed with exit code 1
```
In the above error, the project ID was invalid in the config map.
# Using the InfisicalAuth CRD
Source: https://infisical.com/docs/integrations/platforms/kubernetes/infisical-auth-crd
Learn how to configure the InfisicalAuth CRD to define how the operator authenticates with Infisical.
## Overview
The **InfisicalAuth** CRD defines how the Infisical Operator authenticates with your Infisical instance. It encapsulates the machine identity authentication method and credentials. Once created, it can be referenced by multiple secret resources, so you only need to define authentication details once per identity.
The operator caches authenticated credentials using the token's TTL (at 70% of the expiration time) so that multiple resources sharing the same `InfisicalAuth` don't trigger redundant login calls. The cache is automatically invalidated when the `InfisicalAuth` spec changes or when the referenced `InfisicalConnection` is updated.
### Prerequisites
* The operator is installed on your Kubernetes cluster.
* A [machine identity](/docs/documentation/platform/identities/machine-identities) configured in Infisical with access to the relevant project(s).
* An [InfisicalConnection](/docs/integrations/platforms/kubernetes/infisical-connection-crd) resource created in your cluster.
## Example
You can only define one authentication method per InfisicalAuth resource.
Authenticates using a Kubernetes service account token. This is the recommended method when running inside a Kubernetes cluster. The operator automatically creates short-lived service account tokens (10 minutes) for authentication.
[Read more about Kubernetes Auth](/docs/documentation/platform/identities/kubernetes-auth).
To create an identity, head to your Organization Settings > Access Control > Identities and press **Create identity**.
![identities organization]()
When creating an identity, you specify an organization level [role](/docs/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
![identities organization create]()
Now input a few details for your new identity. Here's some guidance for each field:
* Name (required): A friendly name for the identity.
* Role (required): A role from the **Organization Roles** tab for the identity to assume. The organization role assigned will determine what organization level resources this identity can have access to.
Once you've created an identity, you'll be prompted to configure the authentication method for it. Here, select **Kubernetes Auth**.
To learn more about each field of the Kubernetes native authentication method, see step 2 of [guide](/docs/documentation/platform/identities/kubernetes-auth#guide).
![identities organization create auth method]()
To allow the operator to use the given identity to access secrets, you will need to add the identity to project(s) that you would like to grant it access to.
To do this, head over to the project you want to add the identity to and go to Project Settings > Access Control > Machine Identities and press **Add identity**.
Next, select the identity you want to add to the project and the project level role you want to allow it to assume. The project role assigned will determine what project level resources this identity can have access to.
![identities project]()
![identities project create]()
Create a reviewer service account in your Kubernetes cluster. Infisical uses this account to authenticate with the Kubernetes API Server through the TokenReview API.
```yaml infisical-service-account.yaml theme={"dark"}
apiVersion: v1
kind: ServiceAccount
metadata:
name: infisical-service-account
namespace: default
```
```bash theme={"dark"}
kubectl apply -f infisical-service-account.yaml
```
Bind the service account to the `system:auth-delegator` cluster role. This allows Infisical to perform delegated authentication checks against the TokenReview API.
```yaml infisical-cluster-role-binding.yaml theme={"dark"}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: infisical-service-account-role-binding
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
subjects:
- kind: ServiceAccount
name: infisical-service-account
namespace: default
```
```bash theme={"dark"}
kubectl apply -f infisical-cluster-role-binding.yaml
```
Create a generic Kubernetes secret containing the machine identity ID. Following this example, we'll create a secret named `kubernetes-credentials` in the default namespace, and add the machine identity ID as the value of the `identityId` key.
```bash theme={"dark"}
kubectl create secret generic kubernetes-credentials \
--from-literal=identityId=""
```
You can find the machine identity ID in the Infisical UI by going to Access Control > Machine Identities, and clicking on the identity you want to view the details of.
After you bind the service account to the `system:auth-delegator` cluster role, you are ready to create the `InfisicalAuth` resource using the kubernetes auth method.
```yaml infisical-auth.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
name: my-infisical-auth
spec:
infisicalConnectionRef:
name: my-infisical-connection
namespace: default
method: kubernetes
kubernetes:
identityIdRef:
name: kubernetes-credentials
namespace: default
key: identityId
serviceAccountRef:
name: infisical-service-account
namespace: default
```
```bash theme={"dark"}
kubectl apply -f infisical-auth.yaml
```
**When to use this option**: Choose this approach when you have a gateway deployed in your Kubernetes Cluster and wish to eliminate long-lived tokens. This approach simplifies Infisical Kubernetes Auth configuration, and only one service account will need to have the elevated `system:auth-delegator` ClusterRole binding.
**Note:** Gateway is a paid feature. - **Infisical Cloud users:** Gateway is
available under the **Enterprise Tier**. - **Self-Hosted Infisical:** Please
contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an
enterprise license.
To deploy a gateway in your Kubernetes cluster, follow our [Gateway deployment guide using Helm](/docs/documentation/platform/gateways/gateway-deployment).
To configure your Kubernetes Auth method to use the gateway as the token reviewer, set the `Review Method` to "Gateway as Reviewer", and select the gateway you want to use as the token reviewer.
You can select either an individual gateway or a **Gateway Pool** for automatic failover. When a pool is selected, the platform routes through a healthy gateway at request time. See [Gateway Pools](/docs/documentation/platform/gateways/gateway-pools) for more details.
![identities organization create kubernetes auth method]()
Create a generic Kubernetes secret containing the machine identity ID. Following this example, we'll create a secret named `kubernetes-credentials` in the default namespace, and add the machine identity ID as the value of the `identityId` key.
```bash theme={"dark"}
kubectl create secret generic kubernetes-credentials \
--from-literal=identityId=""
```
After you have set up the Kubernetes Auth prerequisites above, add the identity ID and service account details to your InfisicalAuth resource.
```yaml infisical-auth.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
name: my-infisical-auth
spec:
infisicalConnectionRef:
name: my-infisical-connection
namespace: default
method: kubernetes
kubernetes:
identityIdRef:
name: kubernetes-credentials
namespace: default
key: identityId
serviceAccountRef:
name: infisical-service-account # Change to whichever service account you want the operator to use for authentication.
namespace: default
```
Because you are using the gateway as the token reviewer, you are able to use a different service account for authentication. The gateway sits inside your Kubernetes cluster and has permissions to perform token reviews against the Kubernetes API Server. This means you can use any valid service account in the InfisicalAuth resource, as long as it lives inside the same Kubernetes cluster as the gateway configured inside Infisical.
```bash theme={"dark"}
kubectl apply -f infisical-auth.yaml
```
| Field | Required | Description |
| ------------------------------ | -------- | ----------------------------------------------------------- |
| `identityIdRef` | Yes | Reference to the secret containing the machine identity ID. |
| `serviceAccountRef.name` | Yes | Name of the Kubernetes service account. |
| `serviceAccountRef.namespace` | Yes | Namespace of the service account. |
| `serviceAccountTokenAudiences` | No | Custom audiences for the generated service account token. |
Authenticates using a client ID and client secret. Works anywhere, not tied to any cloud provider.
[Read more about Universal Auth](/docs/documentation/platform/identities/universal-auth).
| Field | Required | Description |
| ----------------- | -------- | -------------------------------------------------------------------- |
| `clientIdRef` | Yes | Reference to the secret containing the universal auth client ID. |
| `clientSecretRef` | Yes | Reference to the secret containing the universal auth client secret. |
You need to create a machine identity, and give it access to the project(s) you want to interact with. You can [read more about machine identities here](/docs/documentation/platform/identities/universal-auth).
Once you have created your machine identity and added it to your project(s), you will need to create a Kubernetes secret containing the identity credentials.
To quickly create a Kubernetes secret containing the identity credentials, you can run the command below.
Make sure you replace `` with the identity client ID and `` with the identity client secret.
```bash theme={"dark"}
kubectl create secret generic universal-auth-credentials \
--from-literal=clientId="" \
--from-literal=clientSecret=""
```
Once the secret is created, add the `secretName` and `secretNamespace` of the secret that was just created under `universal.clientIdRef` and `universal.clientSecretRef` fields in the InfisicalAuth resource. See the full example below for reference.
```yaml infisical-auth.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
name: my-infisical-auth
spec:
infisicalConnectionRef:
name: my-infisical-connection
namespace: default
method: universal
universal:
clientIdRef:
name: universal-auth-credentials
namespace: default
key: clientId
clientSecretRef:
name: universal-auth-credentials
namespace: default
key: clientSecret
```
Apply the resource:
```bash theme={"dark"}
kubectl apply -f infisical-auth.yaml
```
Authenticates using AWS IAM. Can only be used within AWS environments such as EC2, Lambda, and EKS.
[Read more about AWS IAM Auth](/docs/documentation/platform/identities/aws-auth).
| Field | Required | Description |
| --------------- | -------- | ----------------------------------------------------------- |
| `identityIdRef` | Yes | Reference to the secret containing the machine identity ID. |
```yaml infisical-auth.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
name: my-infisical-auth
spec:
infisicalConnectionRef:
name: my-infisical-connection
namespace: default
method: aws-iam
awsIam:
identityIdRef:
name: aws-iam-credentials
namespace: default
key: identityId
```
The referenced Kubernetes secret must contain the machine identity ID:
```bash theme={"dark"}
kubectl create secret generic aws-iam-credentials \
--from-literal=identityId=""
```
Apply the resource:
```bash theme={"dark"}
kubectl apply -f infisical-auth.yaml
```
Authenticates using Azure managed identity. Can only be used within Azure environments.
[Read more about Azure Auth](/docs/documentation/platform/identities/azure-auth).
| Field | Required | Description |
| --------------- | -------- | ----------------------------------------------------------- |
| `identityIdRef` | Yes | Reference to the secret containing the machine identity ID. |
| `resource` | No | The Azure resource (audience) to request a token for. |
```yaml infisical-auth.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
name: my-infisical-auth
spec:
infisicalConnectionRef:
name: my-infisical-connection
namespace: default
method: azure
azure:
identityIdRef:
name: azure-credentials
namespace: default
key: identityId
```
The referenced Kubernetes secret must contain the machine identity ID:
```bash theme={"dark"}
kubectl create secret generic azure-credentials \
--from-literal=identityId=""
```
Apply the resource:
```bash theme={"dark"}
kubectl apply -f infisical-auth.yaml
```
Authenticates using GCP ID tokens. Can only be used within GCP environments.
[Read more about GCP ID Token Auth](/docs/documentation/platform/identities/gcp-auth).
| Field | Required | Description |
| --------------- | -------- | ----------------------------------------------------------- |
| `identityIdRef` | Yes | Reference to the secret containing the machine identity ID. |
```yaml infisical-auth.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
name: my-infisical-auth
spec:
infisicalConnectionRef:
name: my-infisical-connection
namespace: default
method: gcp-id-token
gcpIdToken:
identityIdRef:
name: gcp-id-token-credentials
namespace: default
key: identityId
```
The referenced Kubernetes secret must contain the machine identity ID:
```bash theme={"dark"}
kubectl create secret generic gcp-id-token-credentials \
--from-literal=identityId=""
```
Apply the resource:
```bash theme={"dark"}
kubectl apply -f infisical-auth.yaml
```
Authenticates using GCP IAM with a service account key file. Works both within and outside GCP environments.
[Read more about GCP IAM Auth](/docs/documentation/platform/identities/gcp-auth).
| Field | Required | Description |
| --------------------------- | -------- | --------------------------------------------------------------------- |
| `identityIdRef` | Yes | Reference to the secret containing the machine identity ID. |
| `serviceAccountKeyFilePath` | Yes | Path to the GCP service account key file mounted in the operator pod. |
```yaml infisical-auth.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
name: my-infisical-auth
spec:
infisicalConnectionRef:
name: my-infisical-connection
namespace: default
method: gcp-iam
gcpIam:
identityIdRef:
name: gcp-iam-credentials
namespace: default
key: identityId
serviceAccountKeyFilePath: /path/to/service-account-key.json
```
The referenced Kubernetes secret must contain the machine identity ID:
```bash theme={"dark"}
kubectl create secret generic gcp-iam-credentials \
--from-literal=identityId=""
```
Apply the resource:
```bash theme={"dark"}
kubectl apply -f infisical-auth.yaml
```
Authenticates using LDAP credentials.
[Read more about LDAP Auth](/docs/documentation/platform/identities/ldap-auth).
| Field | Required | Description |
| --------------- | -------- | ----------------------------------------------------------- |
| `identityIdRef` | Yes | Reference to the secret containing the machine identity ID. |
| `usernameRef` | Yes | Reference to the secret containing the LDAP username. |
| `passwordRef` | Yes | Reference to the secret containing the LDAP password. |
```yaml infisical-auth.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
name: my-infisical-auth
spec:
infisicalConnectionRef:
name: my-infisical-connection
namespace: default
method: ldap
ldap:
identityIdRef:
name: ldap-credentials
namespace: default
key: identityId
usernameRef:
name: ldap-credentials
namespace: default
key: username
passwordRef:
name: ldap-credentials
namespace: default
key: password
```
The referenced Kubernetes secret must contain `identityId`, `username`, and `password` keys:
```bash theme={"dark"}
kubectl create secret generic ldap-credentials \
--from-literal=identityId="" \
--from-literal=username="" \
--from-literal=password=""
```
Apply the resource:
```bash theme={"dark"}
kubectl apply -f infisical-auth.yaml
```
## Troubleshooting
You can check the status of your `InfisicalAuth` resource by inspecting its conditions:
```bash theme={"dark"}
kubectl get infisicalauth my-infisical-auth -o jsonpath='{.status.conditions}' | jq
```
When authentication is healthy, the `secrets.infisical.com/IsReady` condition will have `Status: "True"` and `Reason: "OK"`.
If authentication is unhealthy, `Reason` will be set to `Error` and `Message` will contain details about what went wrong.
The `ObservedGeneration` field indicates which generation of the resource spec the operator has last processed. If `ObservedGeneration` is less than `metadata.generation`, the operator has not yet reconciled the latest changes to the resource.
# Using the InfisicalConnection CRD
Source: https://infisical.com/docs/integrations/platforms/kubernetes/infisical-connection-crd
Learn how to configure the InfisicalConnection CRD to define how the operator connects to your Infisical instance.
## Overview
The **InfisicalConnection** CRD defines how the Infisical Operator connects to your Infisical instance. It holds the instance address and an optional TLS configuration. Once created, it can be referenced by multiple `InfisicalAuth` CRDs so you only need to define connection details once per Infisical instance.
### Prerequisites
* The operator is installed on your Kubernetes cluster.
* Access to an Infisical instance (cloud or self-hosted).
## Example
```yaml infisical-connection.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalConnection
metadata:
name: my-infisical-connection
spec:
address: https://app.infisical.com
# tls:
# caCertificate:
# name: secret-containing-ca-certificate
# key: ca.crt
# namespace: default
```
Apply the resource:
```bash theme={"dark"}
kubectl apply -f infisical-connection.yaml
```
## CRD properties
The URL of the Infisical API to connect to.
When `address` is not defined, the operator connects to the address defined by the Helm value `hostAPI`.
For self-hosted instances, set this to `https://your-self-hosted-instance.com`.
This block defines TLS settings for connecting to the Infisical instance.
A reference to a Kubernetes secret containing a CA certificate for SSL/TLS connections.
* `name`: Name of the Kubernetes secret containing the CA certificate.
* `namespace`: Namespace of the Kubernetes secret containing the CA certificate.
* `key`: The key within the secret that holds the CA certificate value.
```yaml theme={"dark"}
tls:
caCertificate:
name: secret-containing-ca-certificate
namespace: default
key: ca.crt
```
## Troubleshooting
You can check the status of your `InfisicalConnection` resource by inspecting its conditions:
```bash theme={"dark"}
kubectl get infisicalconnection my-infisical-connection -o jsonpath='{.status.conditions}' | jq
```
When the connection is healthy, the `secrets.infisical.com/IsReady` condition will have `Status: "True"` and `Reason: "OK"`.
If the connection is unhealthy, `Reason` will be set to `Error` and `Message` will contain details about what went wrong.
The `ObservedGeneration` field indicates which generation of the resource spec the operator has last processed. If `ObservedGeneration` is less than `metadata.generation`, the operator has not yet reconciled the latest changes to the resource.
# Using the InfisicalDynamicSecret CRD
Source: https://infisical.com/docs/integrations/platforms/kubernetes/infisical-dynamic-secret-crd
Learn how to generate dynamic secret leases in Infisical and sync them to your Kubernetes cluster.
## Overview
The **InfisicalDynamicSecret** CRD allows you to easily create and manage dynamic secret leases in Infisical and automatically sync them to your Kubernetes cluster as native **Kubernetes Secret** resources.
This means any Pod, Deployment, or other Kubernetes resource can make use of dynamic secrets from Infisical just like any other K8s secret.
This CRD offers the following features:
* **Generate a dynamic secret lease** in Infisical and track its lifecycle.
* **Write** the dynamic secret from Infisical to your cluster as native Kubernetes secret.
* **Automatically rotate** the dynamic secret value before it expires to make sure your cluster always has valid credentials.
* **Optionally trigger redeployments** of any workloads that consume the secret if you enable auto-reload.
### Prerequisites
* A project within Infisical.
* A [machine identity](/docs/documentation/platform/identities/machine-identities) ready for use in Infisical that has permissions to create dynamic secret leases in the project.
* You have already configured a dynamic secret in Infisical.
* The operator is installed on to your Kubernetes cluster.
## Configure Dynamic Secret CRD
The example below shows a sample **InfisicalDynamicSecret** CRD that creates a dynamic secret lease in Infisical, and syncs the lease to your Kubernetes cluster.
```yaml dynamic-secret-crd.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalDynamicSecret
metadata:
name: infisicaldynamicsecret
spec:
hostAPI: https://app.infisical.com/api # Optional, defaults to https://app.infisical.com/api
dynamicSecret:
secretName:
projectId:
secretsPath: # Root directory is /
environmentSlug:
# Lease revocation policy defines what should happen to leases created by the operator if the CRD is deleted.
# If set to "Revoke", leases will be revoked when the InfisicalDynamicSecret CRD is deleted.
leaseRevocationPolicy: Revoke
# Lease TTL defines how long the lease should last for the dynamic secret.
# This value must be less than 1 day, and if a max TTL is defined on the dynamic secret, it must be below the max TTL.
leaseTTL: 1m
# A reference to the secret that the dynamic secret lease should be stored in.
# If the secret doesn't exist, it will automatically be created.
managedSecretReference:
secretName:
secretNamespace: default # Must be the same namespace as the InfisicalDynamicSecret CRD.
creationPolicy: Orphan
# Only have one authentication method defined or you are likely to run into authentication issues.
# Remove all except one authentication method.
authentication:
awsIamAuth:
identityId:
azureAuth:
identityId:
gcpIamAuth:
identityId:
serviceAccountKeyFilePath:
gcpIdTokenAuth:
identityId:
ldapAuth:
identityId:
credentialsRef:
secretName: # ldap-auth-credentials
secretNamespace: # default
kubernetesAuth:
identityId:
serviceAccountRef:
name:
namespace:
universalAuth:
credentialsRef:
secretName: # universal-auth-credentials
secretNamespace: # default
```
Apply the InfisicalDynamicSecret CRD to your cluster.
```bash theme={"dark"}
kubectl apply -f dynamic-secret-crd.yaml
```
After applying the InfisicalDynamicSecret CRD, you should notice that the dynamic secret lease has been created in Infisical and synced to your Kubernetes cluster. You can verify that the lease has been created by doing:
```bash theme={"dark"}
kubectl get secret -o yaml
```
After getting the secret, you should should see that the secret has data that contains the lease credentials.
```yaml theme={"dark"}
apiVersion: v1
data:
DB_PASSWORD: VHhETjZ4c2xsTXpOSWdPYW5LLlRyNEc2alVKYml6WiQjQS0tNTdodyREM3ZLZWtYSi4hTkdyS0F+TVFsLU9CSA==
DB_USERNAME: cHg4Z0dJTUVBcHdtTW1aYnV3ZWRsekJRRll6cW4wFEE=
kind: Secret
# .....
```
### InfisicalDynamicSecret CRD properties
If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to
`https://your-self-hosted-instace.com/api`
When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud.
If you have installed your Infisical instance within the same cluster as the Infisical operator, you can optionally access the Infisical backend's service directly without having to route through the public internet.
To achieve this, use the following address for the hostAPI field:
```bash theme={"dark"}
http://..svc.cluster.local:4000/api
```
Make sure to replace `` and `` with the appropriate values for your backend service and namespace.
The `leaseTTL` is a string-formatted duration that defines the time the lease should last for the dynamic secret.
The format of the field is `[duration][unit]` where `duration` is a number and `unit` is a string representing the unit of time.
The following units are supported:
* `s` for seconds (must be at least 5 seconds)
* `m` for minutes
* `h` for hours
* `d` for days
The lease duration at most be 1 day (24 hours). And the TTL must be less than the max TTL defined on the dynamic secret.
The `managedSecretReference` field is used to define the Kubernetes secret where the dynamic secret lease should be stored. The required fields are `secretName` and `secretNamespace`.
```yaml theme={"dark"}
spec:
managedSecretReference:
secretName:
secretNamespace: default
```
The name of the Kubernetes secret where the dynamic secret lease should be
stored.
The namespace of the Kubernetes secret where the dynamic secret lease should
be stored.
Creation policies allow you to control whether or not owner references should be added to the managed Kubernetes secret that is generated by the Infisical operator.
This is useful for tools such as ArgoCD, where every resource requires an owner reference; otherwise, it will be pruned automatically.
#### Available options
* `Orphan` (default)
* `Owner`
When creation policy is set to `Owner`, the `InfisicalDynamicSecret` CRD must be in
the same namespace as the managed kubernetes secret.
This field is optional.
Override the default Opaque type for managed secrets with this field. Useful for creating kubernetes.io/dockerconfigjson secrets.
This field is optional.
The field is optional and will default to `None` if not defined.
The lease revocation policy defines what the operator should do with the leases created by the operator, when the InfisicalDynamicSecret CRD is deleted.
Valid values are `None` and `Revoke`.
Behavior of each policy:
* `None`: The operator will not override existing secrets in Infisical. If a secret with the same key already exists, the operator will skip pushing that secret, and the secret will not be managed by the operator.
* `Revoke`: The operator will revoke the leases created by the operator when the InfisicalDynamicSecret CRD is deleted.
```yaml theme={"dark"}
spec:
leaseRevocationPolicy: Revoke
```
The `dynamicSecret` field is used to specify which dynamic secret to create leases for. The required fields are `secretName`, `projectId`, `secretsPath`, and `environmentSlug`.
```yaml theme={"dark"}
spec:
dynamicSecret:
secretName:
# Use either projectId OR projectSlug, not both
projectId: # Either projectId or projectSlug is required
# projectSlug:
environmentSlug:
secretsPath:
```
The name of the dynamic secret.
The project ID of where the dynamic secret is stored in Infisical.
Please note that you can only use either `projectId` or `projectSlug` in the `dynamicSecret` field.
The project slug of where the dynamic secret is stored in Infisical.
Please note that you can only use either `projectId` or `projectSlug` in the `dynamicSecret` field.
The environment slug of where the dynamic secret is stored in Infisical.
The path of where the dynamic secret is stored in Infisical. The root path is
`/`.
The `authentication` field dictates which authentication method to use when pushing secrets to Infisical.
The available authentication methods are `universalAuth`, `kubernetesAuth`, `awsIamAuth`, `azureAuth`, `gcpIdTokenAuth`, and `gcpIamAuth`.
The universal authentication method is one of the easiest ways to get started with Infisical. Universal Auth works anywhere and is not tied to any specific cloud provider.
[Read more about Universal Auth](/docs/documentation/platform/identities/universal-auth).
Valid fields:
* `identityId`: The identity ID of the machine identity you created.
* `credentialsRef`: The name and namespace of the Kubernetes secret that stores the service token.
* `credentialsRef.secretName`: The name of the Kubernetes secret.
* `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret.
Example:
```yaml theme={"dark"}
# infisical-push-secret.yaml
spec:
universalAuth:
credentialsRef:
secretName:
secretNamespace:
```
```yaml theme={"dark"}
# machine-identity-credentials.yaml
apiVersion: v1
kind: Secret
metadata:
name: universal-auth-credentials
type: Opaque
stringData:
clientId:
clientSecret:
```
The Kubernetes machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalDynamicSecret resource. This authentication method can only be used within a Kubernetes environment.
[Read more about Kubernetes Auth](/docs/documentation/platform/identities/kubernetes-auth).
Valid fields:
* `identityId`: The identity ID of the machine identity you created.
* `serviceAccountRef`: The name and namespace of the service account that will be used to authenticate with Infisical.
* `serviceAccountRef.name`: The name of the service account.
* `serviceAccountRef.namespace`: The namespace of the service account.
* `autoCreateServiceAccountToken`: If set to `true`, the operator will automatically create a short-lived service account token on-demand for the service account. Defaults to `false`.
* `serviceAccountTokenAudiences`: Optionally specify audience for the service account token. This field is only relevant if you have set `autoCreateServiceAccountToken` to `true`. No audience is specified by default.
Example:
```yaml theme={"dark"}
spec:
kubernetesAuth:
identityId:
autoCreateServiceAccountToken: true # Automatically creates short-lived service account tokens for the service account.
serviceAccountTokenAudiences:
- # Optionally specify audience for the service account token. No audience is specified by default.
serviceAccountRef:
name:
namespace:
```
The LDAP machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/docs/documentation/platform/identities/ldap-auth).
Valid fields:
* `identityId`: The identity ID of the machine identity you created.
* `credentialsRef`: The name and namespace of the Kubernetes secret that stores the LDAP credentials.
* `credentialsRef.secretName`: The name of the Kubernetes secret.
* `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret.
Example:
```yaml theme={"dark"}
# infisical-push-secret.yaml
spec:
ldapAuth:
identityId:
credentialsRef:
secretName:
secretNamespace:
```
```yaml theme={"dark"}
# machine-identity-credentials.yaml
apiVersion: v1
kind: Secret
metadata:
name: ldap-auth-credentials
type: Opaque
stringData:
username:
password:
```
The AWS IAM machine identity authentication method is used to authenticate with Infisical.
[Read more about AWS IAM Auth](/docs/documentation/platform/identities/aws-auth).
Valid fields:
* `identityId`: The identity ID of the machine identity you created.
Example:
```yaml theme={"dark"}
spec:
authentication:
awsIamAuth:
identityId:
```
The AWS IAM machine identity authentication method is used to authenticate with Infisical. Azure Auth can only be used from within an Azure environment.
[Read more about Azure Auth](/docs/documentation/platform/identities/azure-auth).
Valid fields:
* `identityId`: The identity ID of the machine identity you created.
Example:
```yaml theme={"dark"}
spec:
authentication:
azureAuth:
identityId:
```
The GCP IAM machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalDynamicSecret resource. This authentication method can only be used both within and outside GCP environments.
[Read more about Azure Auth](/docs/documentation/platform/identities/gcp-auth).
Valid fields:
* `identityId`: The identity ID of the machine identity you created.
* `serviceAccountKeyFilePath`: The path to the GCP service account key file.
Example:
```yaml theme={"dark"}
spec:
gcpIamAuth:
identityId:
serviceAccountKeyFilePath:
```
The GCP ID Token machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalDynamicSecret resource. This authentication method can only be used within GCP environments.
[Read more about Azure Auth](/docs/documentation/platform/identities/gcp-auth).
Valid fields:
* `identityId`: The identity ID of the machine identity you created.
Example:
```yaml theme={"dark"}
spec:
gcpIdTokenAuth:
identityId:
```
This block defines the TLS settings to use for connecting to the Infisical
instance.
Fields:
This block defines the reference to the CA certificate to use for connecting to the Infisical instance with SSL/TLS.
Valid fields:
* `secretName`: The name of the Kubernetes secret containing the CA certificate to use for connecting to the Infisical instance with SSL/TLS.
* `secretNamespace`: The namespace of the Kubernetes secret containing the CA certificate to use for connecting to the Infisical instance with SSL/TLS.
* `key`: The name of the key in the Kubernetes secret which contains the value of the CA certificate to use for connecting to the Infisical instance with SSL/TLS.
Example:
```yaml theme={"dark"}
tls:
caRef:
secretName: custom-ca-certificate
secretNamespace: default
key: ca.crt
```
### Applying the InfisicalDynamicSecret CRD to your cluster
Once you have configured the `InfisicalDynamicSecret` CRD with the required fields, you can apply it to your cluster. After applying, you should notice that a lease has been created in Infisical and synced to your Kubernetes cluster.
```bash theme={"dark"}
kubectl apply -f dynamic-secret-crd.yaml
```
## Auto redeployment
Deployments referring to Kubernetes secrets containing Infisical dynamic secrets don't automatically reload when the dynamic secret lease expires. This means your deployment may use expired dynamic secrets unless manually redeployed.
To address this, we've added functionality to automatically redeploy your deployment when the associated Kubernetes secret containing your Infisical dynamic secret updates.
#### Enabling auto redeploy
To enable auto redeployment you simply have to add the following annotation to the deployment, statefulset, or daemonset that consumes a managed secret.
```yaml theme={"dark"}
secrets.infisical.com/auto-reload: "true"
```
```yaml theme={"dark"}
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
labels:
app: nginx
annotations:
secrets.infisical.com/auto-reload: "true" # <- redeployment annotation
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:1.14.2
envFrom:
- secretRef:
name: managed-secret # The name of your managed secret, the same that you're using in your InfisicalDynamicSecret CRD (spec.managedSecretReference.secretName)
ports:
- containerPort: 80
```
#### How it works
When the lease changes, the operator will check to see which deployments are using the operator-managed Kubernetes secret that received the update.
Then, for each deployment that has this annotation present, a rolling update will be triggered. A redeployment won't happen if the lease is renewed, only if it's recreated.
# Using the InfisicalPushSecret CRD
Source: https://infisical.com/docs/integrations/platforms/kubernetes/infisical-push-secret-crd
Learn how to use the InfisicalPushSecret CRD to push and manage secrets in Infisical.
## Overview
The **InfisicalPushSecret** CRD allows you to create secrets in your Kubernetes cluster and push them to Infisical.
This CRD offers the following features:
* **Push Secrets** from a Kubernetes secret into Infisical.
* **Manage secret lifecycle** of pushed secrets in Infisical. When the Kubernetes secret is updated, the operator will automatically update the secrets in Infisical. Optionally, when the Kubernetes secret is deleted, the operator will delete the secrets in Infisical automatically.
### Prerequisites
* A project within Infisical.
* A [machine identity](/docs/documentation/platform/identities/machine-identities) ready for use in Infisical that has permissions to create secrets in your project.
* The operator is installed on to your Kubernetes cluster.
## Example usage
Below is a sample InfisicalPushSecret CRD that pushes secrets defined in a Kubernetes secret to Infisical.
After filling out the fields in the InfisicalPushSecret CRD, you can apply it directly to your cluster.
Before applying the InfisicalPushSecret CRD, you need to create a Kubernetes secret containing the secrets you want to push to Infisical. An example can be seen below the InfisicalPushSecret CRD.
```yaml infisical-push-secret.yaml theme={"dark"}
apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalPushSecret
metadata:
name: infisical-push-secret-demo
spec:
resyncInterval: 1m # Remove this field to disable automatic reconciliation of the InfisicalPushSecret CRD.
hostAPI: https://app.infisical.com/api
# Optional, defaults to no replacement.
updatePolicy: Replace # If set to replace, existing secrets inside Infisical will be replaced by the value of the PushSecret on sync.
# Optional, defaults to no deletion.
deletionPolicy: Delete # If set to delete, the secret(s) inside Infisical managed by the operator, will be deleted if the InfisicalPushSecret CRD is deleted.
destination:
projectId: # Either projectId or projectSlug is required
projectSlug:
environmentSlug:
secretsPath:
push:
secret:
secretName: push-secret-demo # Secret CRD
secretNamespace: default
# Only have one authentication method defined or you are likely to run into authentication issues.
# Remove all except one authentication method.
authentication:
awsIamAuth:
identityId:
azureAuth:
identityId:
gcpIamAuth:
identityId:
serviceAccountKeyFilePath:
gcpIdTokenAuth:
identityId:
kubernetesAuth:
identityId:
serviceAccountRef:
name:
namespace:
ldapAuth:
identityId:
credentialsRef:
secretName: # ldap-auth-credentials
secretNamespace: # default
universalAuth:
credentialsRef:
secretName: # universal-auth-credentials
secretNamespace: # default
```
```yaml source-secret.yaml theme={"dark"}
apiVersion: v1
kind: Secret
metadata:
name: push-secret-demo
namespace: default
stringData: # can also be "data", but needs to be base64 encoded
API_KEY: some-api-key
DATABASE_URL: postgres://127.0.0.1:5432
ENCRYPTION_KEY: fabcc12-a22-facbaa4-11aa568aab
```
```bash theme={"dark"}
kubectl apply -f source-secret.yaml
```
After applying the soruce-secret.yaml file, you are ready to apply the InfisicalPushSecret CRD.
```bash theme={"dark"}
kubectl apply -f infisical-push-secret.yaml
```
After applying the InfisicalPushSecret CRD, you should notice that the secrets you have defined in your source-secret.yaml file have been pushed to your specified destination in Infisical.
## InfisicalPushSecret CRD properties
If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to
`https://your-self-hosted-instace.com/api`
When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud.
If you have installed your Infisical instance within the same cluster as the Infisical operator, you can optionally access the Infisical backend's service directly without having to route through the public internet.
To achieve this, use the following address for the hostAPI field:
```bash theme={"dark"}
http://