> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# App connections

> Learn how to manage and configure third-party app connections with Infisical.

App connections allow you to integrate your Infisical projects with third-party services.

> [card] [Explore options](https://infisical.com/docs/integrations/app-connections.md)
>
> Browse and search every available app connection.

## Concept

App Connections can be used to establish connections with third-party applications
that can be used across multiple features. Example use cases include syncing secrets, rotating credentials, scanning repositories for secret leaks, and more.

```mermaid theme={"dark"}
%%{init: {'flowchart': {'curve': 'linear'} } }%%
graph TD
A[AWS]
B[AWS Connection]
C[Project 1 Secret Sync]
D[Project 2 Secret Sync]
E[Project 3 Generate Dynamic Secret]

B --> A
C --> B
D --> B
E --> B

classDef default fill:#ffffff,stroke:#666,stroke-width:2px,rx:10px,color:black
classDef aws fill:#FFF2B2,stroke:#E6C34A,stroke-width:2px,color:black,rx:15px
classDef project fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
classDef connection fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px

class A aws
class B connection
class C,D,E project
```

## Where a connection lives

A connection belongs either to a single project or to the whole organization. Both kinds appear in the same dropdown when you set up a feature, so it's worth deciding which you want before you create one.

Create it at the **organization** level when more than one project will use the same account. You get one credential to rotate, one set of permissions to review, and one place to revoke access.

Create it at the **project** level when the credential belongs to that project alone, or when teams manage their own access and you want a clear boundary between them.

> [!WARNING]
>
> Creating a connection from inside a setup form always creates it at the project level. If several teams do this against the same account, you end up storing the same credential several times over. When you expect a connection to be shared, ask an organization admin to create it once at the organization level instead.

## Workflow

App Connections require initial setup in both your third-party application and Infisical. Follow these steps to establish a secure connection:

> [!NOTE]
>
> For step-by-step guides specific to each application, refer to the App Connections section in the sidebar.

1. **Create Access Entity:** If necessary, create an entity such as a service account or role within the third-party application you want to connect to. Be sure
   to limit the access of this entity to the minimal permission set required to perform the operations you need. For example:
   * For secret syncing: Read/write permissions to specific secret stores
   * For dynamic secrets: Permissions to create temporary credentials

> [!TIP]
>
> Whenever possible, Infisical encourages creating a designated service account for your App Connection to limit the scope of permissions based on your use-case.

2. **Generate Authentication Credentials:** Obtain the required credentials from your third-party application. These can vary between applications and might be:
   * an API key or access token
   * A client ID and secret pair
   * other credentials, etc.

3. **Create App Connection:** Configure the connection in Infisical using your generated credentials through either the UI or API.

> [!TIP]
>
> You don't have to do this in advance. Secret syncs, secret rotations, certificate syncs, and secret scanning data sources all let you create a connection from inside their setup form without losing your progress.

> [!NOTE]
>
> Some App Connections can only be created via the UI such as connections using OAuth.

4. **Utilize the Connection:** Use your App Connection for various features across Infisical such as our Secrets Sync by selecting it via the dropdown menu
   in the UI or by passing the associated `connectionId` when generating resources via the API.

## Platform managed credentials

Some App Connections support the ability to have their credentials managed by Infisical. By enabling this option,
Infisical will modify the credentials to prevent external use of the configured access entity.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.