> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Daytona sync

> Learn how to configure a Daytona sync for Infisical.

A Daytona Secret Sync pushes secrets from Infisical into a Daytona organization, where sandboxes can read them at runtime. Each Infisical secret becomes a Daytona secret with the same name, unless you customize key names to add a prefix or suffix.

> [!NOTE]
>
> The Daytona Secret Sync requires a [Daytona app connection](https://infisical.com/docs/integrations/app-connections/daytona.md). This guide walks you through creating a project-scoped app connection.

## Prerequisites

* A [project with secrets configured](https://infisical.com/docs/documentation/platform/secrets-mgmt/quick-starts/deliver-first-secret.md)
* A [Daytona account](https://app.daytona.io/) with access to create API keys in the organization you want to sync secrets to

## Step 1: Create a Daytona API key

Infisical authenticates to Daytona with an API key that can manage secrets in your organization.

**Step 1**

In the Daytona dashboard, go to **API Keys** in the sidebar, then select **Create Key**.

**Step 2**

Give the key a name. Under **Permissions**, select **Restricted**, then set **Secrets** to **Manage** (or **Full Access**).

> [!NOTE]
>
> Infisical needs this permission to create, update, and delete secrets. If the key doesn't have it, Infisical rejects the key when you create the connection.

![Create API Key](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/daytona/create-api-key.png)

**Step 3**

Select **Create**, then copy the key. Daytona shows the key only once, and you need it to create the connection in Infisical.

## Step 2: Set up the sync in Infisical

> [!TIP]
>
> To create the sync using the API, use the [Create Daytona Sync](https://infisical.com/docs/api-reference/endpoints/secret-syncs/daytona/create.md) endpoint.

**Step 1**

In your project, go to **Integrations** and open the **Secret Syncs** tab. Select **+ Add Sync**.

![Secret Syncs Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/general/secret-sync-tab.png)

Then, select the **Daytona** sync.

![Select Daytona](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/daytona/select-option.png)

**Step 2**

Under **Source**, choose which secrets to sync from Infisical:

* **Environment**: The project environment to retrieve secrets from
* **Secret Path**: The folder path to retrieve secrets from

> [!NOTE]
>
> Daytona secret names must start with a letter or an underscore, and can contain only letters, digits, hyphens, and underscores. If any secret at this path has a name Daytona rejects, the sync fails without writing any secrets, and the error names each rejected key.

> [!TIP]
>
> If you need to sync secrets from multiple folder locations, use [secret imports](https://infisical.com/docs/documentation/platform/secret-reference.md#secret-imports).

Then select **Continue**.

**Step 3**

Under **Destination**, create or select the Daytona app connection the sync will use. The connection's API key decides which Daytona organization receives the secrets, so there is nothing else to configure on this screen.

> [tab] Create a new app connection
>
> Under **Daytona Connection**, select **Create Connection** in the dropdown, then fill in:
>
> * **Name**: A descriptive name for the connection, such as `daytona-prod`
> * **Description** (optional): A note for future reference
> * **Method**: **API Key** (selected by default)
> * **API Key**: The key you copied when you [created the Daytona API key](#step-1-create-a-daytona-api-key)
>
> Select **Connect to Daytona**. Infisical returns you to the sync form with the new connection selected.
>
> > [!NOTE]
> >
> > This creates a connection scoped to the current project. To share the connection across other projects, [create it at the organization level](https://infisical.com/docs/integrations/app-connections/daytona.md#step-2-create-the-app-connection) first, then select it here.

> [tab] Use an existing connection
>
> Under **Daytona Connection**, select the app connection you'd like to use.

![Configure Destination](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/daytona/configure-destination.png)

Then select **Continue**.

**Step 4**

Under **Initial Sync Behavior**, select **Overwrite Daytona**, then select **Continue**.

> [!NOTE]
>
> Daytona's API never returns a secret's value, so this sync can't import existing Daytona secrets into Infisical. **Overwrite Daytona** is the only option.

![Initial Sync Behavior](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/daytona/initial-sync-behavior.png)

**Step 5**

Under **Sync Options**, choose how secrets are synced:

* **Prevent secret deletion**: When enabled, Infisical adds and updates secrets in Daytona but never deletes them; enable this if you manage some Daytona secrets outside of Infisical
* **Auto-sync on changes**: When enabled, secrets sync to Daytona automatically as the source changes. Turn off to sync manually only
* **Customize key names**: Adds a prefix or suffix to every synced name, using `{{secretKey}}` for the original name and `{{environment}}` for the environment slug

> [!WARNING]
>
> Daytona secrets belong to the whole organization, so a sync can change secrets that were created outside Infisical. If you don't customize key names, the sync treats every secret in the organization as one it manages:
>
> * A Daytona secret with the same name as an Infisical secret has its value overwritten
> * If **Prevent secret deletion** is off, every Daytona secret that isn't in Infisical is deleted
>
> With customized key names, the sync writes only names with your prefix or suffix, and deletes only Daytona secrets whose names match it.
>
> Before the first sync, customize key names or keep **Prevent secret deletion** on. **Prevent secret deletion** is on by default when you create the sync in the UI, but off unless you set `disableSecretDeletion` when you create it through the API.

![Configure Sync Options](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/daytona/configure-sync-options.png)

Then select **Continue**.

**Step 6**

Give the sync a **Name** and an optional **Description**. The name must be slug-friendly.

![Sync Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/daytona/configure-details.png)

Then select **Continue**.

**Step 7**

Review your Daytona Sync configuration, then select **Create Sync**.

![Review and Create](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/daytona/review-configuration.png)

> [!TIP]
>
> The sync is created. If **Auto-sync on changes** is enabled, it begins syncing secrets to your Daytona organization right away.

## Step 3: Restrict allowed hosts in Daytona

Daytona never places a secret's value in a sandbox. It sets the environment variable to a placeholder and substitutes the real value in its egress proxy, but only for requests to hosts on that secret's allowed hosts list. If a secret has no allowed hosts, Daytona substitutes the value in a request to any host.

> [!NOTE]
>
> Infisical never sets or changes allowed hosts. When Infisical creates a Daytona secret, it sends only the name and value, and when it updates one, it sends only the value. This means the allowed hosts you set in Daytona stay in place through every later sync.

After the first sync creates your secrets, set allowed hosts on each one in Daytona. Each secret has its own list, so you can limit each secret to the hosts it's used with.

**Step 1**

In the Daytona dashboard, go to **Secrets** in the sidebar. The secrets created by the sync are listed by name, and the **Allowed Hosts** column shows each one's current list.

**Step 2**

Find the secret you want to restrict and select it.

**Step 3**

In **Allowed Hosts**, enter a comma-separated list of the hosts the secret may be sent to, such as `api.anthropic.com`. Then save the secret.

![Allowed hosts on a Daytona secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/daytona/allowed-hosts.png)

Repeat these steps for each secret you want to restrict.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.