> ## Documentation Index
> Fetch the complete documentation index at: https://ryvn.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Infisical

> Connect an Infisical machine identity to sync secrets into Ryvn variable groups

The Infisical connection authenticates with a machine identity using Universal Auth. After configuring it, [import secrets into a variable group](/docs/configure/variable-groups#infisical).

## Before you begin

You need an Infisical project containing secrets, access to configure its machine identities, and permission to manage integrations in Ryvn.

## Configure the connection

<Steps>
  <Step title="Create a machine identity">
    In your Infisical organization, open **Access Control > Machine Identities** and create an identity such as `ryvn-secret-sync`. Give it the organization Member role.
  </Step>

  <Step title="Configure Universal Auth and project access">
    Open the identity and configure **Universal Auth** under Authentication. Add the identity to the project containing your secrets and grant it permission to read the environments and paths you plan to import.

    <Frame>
      <img src="https://mintcdn.com/ryvntechnologies/CSMp9UxJUOz_JIjq/screenshots/machine-identity-page.png?fit=max&auto=format&n=CSMp9UxJUOz_JIjq&q=85&s=87b4d7571652f11d4adb29e13ed32975" alt="Infisical machine identity with Universal Auth and Add to Project controls" width="3426" height="1952" data-path="screenshots/machine-identity-page.png" />
    </Frame>

    See [Infisical's machine identity guide](https://infisical.com/blog/introducing-machine-identities) for how project access and Universal Auth work together.
  </Step>

  <Step title="Create a client secret">
    Under Universal Auth, create a client secret. Copy the **Client ID** and **Client Secret** for the next step.
  </Step>

  <Step title="Add the connection in Ryvn">
    <Tabs>
      <Tab title="Dashboard">
        Open **Settings > Connections > Infisical** and click **Add Connection**.

        | Field | Value |
        | - | - |
        | Name | A name such as `infisical-production` |
        | API URL | Your Infisical base URL, such as `https://app.infisical.com`, or the URL for your region or self-hosted instance |
        | Client ID | The machine identity's Universal Auth client ID |
        | Client Secret | The client secret you just created |

        Click **Create Connection**.

        <Frame>
          <img src="https://mintcdn.com/ryvntechnologies/EqroOAhyYMhnwkDL/screenshots/infisical-create.jpg?fit=max&auto=format&n=EqroOAhyYMhnwkDL&q=85&s=7bd5193000c080ba2174e0ec11701b22" alt="Ryvn Infisical connection form with name, API URL, client ID, and masked client secret" width="608" height="472" data-path="screenshots/infisical-create.jpg" />
        </Frame>
      </Tab>

      <Tab title="CLI">
        [Authenticate the CLI](/docs/cli#authenticate). Set `INFISICAL_CLIENT_ID` and `INFISICAL_CLIENT_SECRET` in your shell to the credentials from the previous step, then run:

        ```bash theme={null}
        ryvn create connection infisical-production \
          --type infisical \
          --auth-method universal_auth \
          --api-url https://app.infisical.com \
          --client-id "$INFISICAL_CLIENT_ID" \
          --client-secret "$INFISICAL_CLIENT_SECRET"
        ```

        Use your region's or self-hosted instance's base URL for `--api-url`.
      </Tab>
    </Tabs>
  </Step>

  <Step title="Test and import">
    <Tabs>
      <Tab title="Dashboard">
        Click **Test** on the connection.
      </Tab>

      <Tab title="CLI">
        ```bash theme={null}
        ryvn test connection infisical-production
        ryvn describe connection infisical-production
        ```
      </Tab>
    </Tabs>

    Once the test succeeds, [import a variable group](/docs/configure/variable-groups#infisical) and choose the Infisical project, environment, and secret path.
  </Step>
</Steps>

## Rotate credentials

Create a replacement client secret in Infisical, then **Edit** the connection in Ryvn. Enter the replacement credentials and save. Leave credential fields blank when editing if you want to keep their existing values.

The CLI does not currently provide a connection-update command; rotate stored credentials in the dashboard.

Test the connection and run **Sync now** on an imported group before revoking the old secret in Infisical.

## Troubleshooting

If the connection test fails, check the API URL, client ID, client secret, and any network restrictions on the Infisical instance. For a self-hosted instance, the Ryvn hub must be able to reach its API.

If the test succeeds but an import fails, check the machine identity's access to the selected project, environment, and secret path. Review the variable group's sync error and retry after correcting access.

Ryvn blocks deleting this connection while imported groups use it. Replace those groups in consuming installations and remove the groups before deleting the connection.