> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Log in as a machine identity and use the returned access token on every Infisical API request.

To call the Infisical API, you need to authenticate as a [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md) using one of the authentication methods listed below. The authentication method returns a short-lived access token. Include that token as an `Authorization: Bearer <token>` header on every Infisical API request.

> [!NOTE]
>
> For a guide on authenticating with Universal Auth and calling the API, check out the [Quickstart](https://infisical.com/docs/api-reference/overview/quickstart.md).

## Authentication methods

Each authentication method accepts a different type of credential:

### Infisical-issued credentials

These methods accept credentials that Infisical creates and manages directly, such as a client ID and client secret or a long-lived access token. They work from any environment.

> [card] [Universal Auth](https://infisical.com/docs/documentation/platform/identities/universal-auth.md)
>
> Authenticate with a client ID and client secret.

> [card] [Token Auth](https://infisical.com/docs/documentation/platform/identities/token-auth.md)
>
> Authenticate with a long-lived, manually issued access token.

### Cloud providers

Cloud providers accept the identity the calling workload already has on that cloud, such as an IAM role, a managed identity, or a service account.

> [card] [AWS Auth](https://infisical.com/docs/documentation/platform/identities/aws-auth.md)
>
> Authenticate from an EC2 instance, ECS task, Lambda function, or any AWS workload with an IAM role.

> [card] [Azure Auth](https://infisical.com/docs/documentation/platform/identities/azure-auth.md)
>
> Authenticate from an Azure workload with a managed identity.

> [card] [GCP Auth](https://infisical.com/docs/documentation/platform/identities/gcp-auth.md)
>
> Authenticate from a Compute Engine instance, GKE pod, or Cloud Run service using its GCP service account.

> [card] [Kubernetes Auth](https://infisical.com/docs/documentation/platform/identities/kubernetes-auth.md)
>
> Authenticate from a Kubernetes pod using its service account token.

> [card] [OCI Auth](https://infisical.com/docs/documentation/platform/identities/oci-auth.md)
>
> Authenticate from an Oracle Cloud compute instance using its instance principal.

> [card] [AliCloud Auth](https://infisical.com/docs/documentation/platform/identities/alicloud-auth.md)
>
> Authenticate from an Alibaba Cloud workload using an assumed RAM role.

### External identity

These methods accept a credential from a trusted external system, such as an OIDC identity token, a JWT signed by a trusted issuer, an LDAP bind, a client certificate, or a SPIFFE SVID.

> [card] [OIDC Auth](https://infisical.com/docs/documentation/platform/identities/oidc-auth/general.md)
>
> Authenticate with an OIDC identity token from a trusted OIDC provider.

> [card] [JWT Auth](https://infisical.com/docs/documentation/platform/identities/jwt-auth.md)
>
> Authenticate with a JWT signed by a trusted issuer.

> [card] [LDAP Auth](https://infisical.com/docs/documentation/platform/identities/ldap-auth/general.md)
>
> Authenticate against a configured LDAP directory.

> [card] [TLS certificate Auth](https://infisical.com/docs/documentation/platform/identities/tls-cert-auth.md)
>
> Authenticate with a client certificate signed by a trusted certificate authority.

> [card] [SPIFFE Auth](https://infisical.com/docs/documentation/platform/identities/spiffe-auth.md)
>
> Authenticate with a SPIFFE SVID from a workload attested by SPIRE.

## FAQ

> [accordion] Why can I not create, read, update, or delete an identity?
>
> A few reasons this can happen:
>
> * The calling identity doesn't have the org permissions required to manage identities
> * The identity being changed is more privileged than the calling identity
> * The role being assigned is more privileged than any role held by the calling identity

> [accordion] Why is the Infisical API rejecting my identity credentials?
>
> A few reasons this can happen:
>
> * The client secret or access token has expired
> * The identity doesn't have the permissions required by the endpoint
> * The client secret or access token is being used from an IP address the identity doesn't trust


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.