Skip to main content
The Infisical connection authenticates with a machine identity using Universal Auth. After configuring it, import secrets into a variable group.

​
Before you begin

You need an Infisical project containing secrets, access to configure its machine identities, and permission to manage integrations in Ryvn.

​
Configure the connection

1

Create a machine identity

In your Infisical organization, open Access Control > Machine Identities and create an identity such as ryvn-secret-sync. Give it the organization Member role.
2

Configure Universal Auth and project access

Open the identity and configure Universal Auth under Authentication. Add the identity to the project containing your secrets and grant it permission to read the environments and paths you plan to import.
Infisical machine identity with Universal Auth and Add to Project controls
See Infisical’s machine identity guide for how project access and Universal Auth work together.
3

Create a client secret

Under Universal Auth, create a client secret. Copy the Client ID and Client Secret for the next step.
4

Add the connection in Ryvn

Open Settings > Connections > Infisical and click Add Connection.Click Create Connection.
Ryvn Infisical connection form with name, API URL, client ID, and masked client secret
5

Test and import

Click Test on the connection.
Once the test succeeds, import a variable group and choose the Infisical project, environment, and secret path.

​
Rotate credentials

Create a replacement client secret in Infisical, then Edit the connection in Ryvn. Enter the replacement credentials and save. Leave credential fields blank when editing if you want to keep their existing values. The CLI does not currently provide a connection-update command; rotate stored credentials in the dashboard. Test the connection and run Sync now on an imported group before revoking the old secret in Infisical.

​
Troubleshooting

If the connection test fails, check the API URL, client ID, client secret, and any network restrictions on the Infisical instance. For a self-hosted instance, the Ryvn hub must be able to reach its API. If the test succeeds but an import fails, check the machine identity’s access to the selected project, environment, and secret path. Review the variable group’s sync error and retry after correcting access. Ryvn blocks deleting this connection while imported groups use it. Replace those groups in consuming installations and remove the groups before deleting the connection.