> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Infisical connection

> Learn how to configure an Infisical Connection to sync secrets between Infisical instances.

Infisical supports connecting to a remote Infisical instance using a **Machine Identity** (Universal Auth).
This enables you to sync secrets from one Infisical project to another — for example, from your cloud instance to a self-hosted deployment.

## Setup Infisical connection in Infisical

> [tab] Infisical UI
>
> **1. Navigate to the remote Infisical instance**
>
> Open the **remote** Infisical instance (the one you want to sync secrets *to*) and navigate to **Organization** > **Access Control** > **Machine Identities**.
>
> ![Machine Identities Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/external-infisical/machine-identities-tab.png)
>
> **2. Create a Machine Identity**
>
> Create a new Machine Identity. Give it a descriptive name (e.g., `infisical-sync-identity`).
>
> ![Create Machine Identity](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/external-infisical/create-machine-identity.png)
>
> **3. Configure Universal Auth**
>
> Select **Universal Auth** as the authentication method and create the identity.
>
> ![Configure Universal Auth](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/external-infisical/configure-universal-auth.png)
>
> **4. Copy the Client ID and create a Client Secret**
>
> Copy the **Client ID**. Then select **Create Client Secret** and copy the generated secret. Store both values in a secure location — the secret won't be shown again.
>
> ![Copy Client Credentials](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/external-infisical/copy-client-credentials.png)
>
> **5. Add the Machine Identity to the target project**
>
> Navigate to the project on the remote instance that you want to sync secrets to. Under **Access Control** > **Machine Identities**, add the Machine Identity you created and grant it a role with write permission on secrets (e.g. **Member** or a custom role with secret write access).
>
> ![Add Identity to Project](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/external-infisical/add-identity-to-project.png)
>
> **6. Navigate to App Connections in Infisical**
>
> Switch back to your **source** Infisical instance. Go to **Integrations** > **App Connections** in your organization and select **Add Connection**.
>
> ![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)
>
> **7. Select the Infisical Connection option**
>
> Choose the **Infisical** option from the connection list.
>
> ![Select Infisical Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/external-infisical/select-external-infisical-connection-option.png)
>
> **8. Fill in the connection form**
>
> Complete the connection form with the following details:
>
> * **Instance URL**: The base URL of the remote Infisical instance (e.g., `https://infisical.example.com`).
> * **Machine Identity Client ID**: The Client ID copied in a previous step.
> * **Machine Identity Client Secret**: The Client Secret copied in a previous step.
>
>   ![Infisical Connection Form](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/external-infisical/external-infisical-connection-form.png)
>
> **9. Connection Created**
>
> Your **Infisical Connection** is now available for use in Secret Syncs.
>
> ![Connection Created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/external-infisical/external-infisical-connection-created.png)

> [tab] API
>
> To create an Infisical Connection, make an API request to the [Create Infisical Connection](https://infisical.com/docs/api-reference/endpoints/app-connections/external-infisical/create.md) API endpoint.
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl    --request POST \
>         --url https://app.infisical.com/api/v1/app-connections/external-infisical \
>         --header 'Content-Type: application/json' \
>         --data '{
>             "name": "my-infisical-connection",
>             "method": "machine-identity-universal-auth",
>             "credentials": {
>                 "instanceUrl": "https://infisical.example.com",
>                 "machineIdentityClientId": "<client-id>",
>                 "machineIdentityClientSecret": "<client-secret>"
>             }
>         }'
> ```
>
> ### Sample response
>
> ```bash Response theme={"dark"}
> {
>     "appConnection": {
>         "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "name": "my-infisical-connection",
>         "version": 1,
>         "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
>         "createdAt": "2025-04-01T05:31:56Z",
>         "updatedAt": "2025-04-01T05:31:56Z",
>         "app": "external-infisical",
>         "method": "machine-identity-universal-auth",
>         "credentials": {
>             "instanceUrl": "https://infisical.example.com",
>             "machineIdentityClientId": "<client-id>"
>         }
>     }
> }
> ```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.