> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Learn how to sync secrets to third-party services with Infisical.

Secret Syncs enable you to sync secrets from Infisical to third-party services using [App Connections](https://infisical.com/docs/integrations/app-connections/overview.md).

## Concept

Secret Syncs are a project-level resource used to sync secrets, via an [App Connection](https://infisical.com/docs/integrations/app-connections/overview.md), from a particular project environment and folder path (source)
to a third-party service (destination). Changes to the source will automatically be propagated to the destination, ensuring
your secrets are always up-to-date.

```mermaid theme={"dark"}
%%{init: {'flowchart': {'curve': 'linear'} } }%%
graph LR
A[App Connection]
B[Secret Sync]
C[Secret 1]
D[Secret 2]
E[Secret 3]
F[Third-Party Service]
G[Secret 1]
H[Secret 2]
I[Secret 3]
J[Project Source]

B --> A
C --> J
D --> J
E --> J
A --> F
F --> G
F --> H
F --> I
J --> B

classDef default fill:#ffffff,stroke:#666,stroke-width:2px,rx:10px,color:black
classDef connection fill:#FFF2B2,stroke:#E6C34A,stroke-width:2px,color:black,rx:15px
classDef secret fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
classDef sync fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
classDef service fill:#E6E6FF,stroke:#6B4E96,stroke-width:2px,color:black,rx:15px
classDef project fill:#FFE6E6,stroke:#D63F3F,stroke-width:2px,color:black,rx:15px

class A connection
class B sync
class C,D,E,G,H,I secret
class F project
class J service
```

## Workflow

Configuring a Secret Sync requires three components: a **source** location to retrieve secrets from,
a **destination** endpoint to deploy secrets to, and **configuration options** to determine how your secrets
should be synced. Follow these steps to start syncing:

> [!NOTE]
>
> For step-by-step guides on syncing to a particular third-party service, refer to the Secret Syncs section in the Navigation Bar.

1. **Create App Connection:** If you haven't already done so, create an [App Connection](https://infisical.com/docs/integrations/app-connections/overview.md)
   via the UI or API for the third-party service you intend to sync secrets to.

2. **Create Secret Sync:** Configure a Secret Sync in the desired project by specifying the following parameters via the UI or API:
   * **Source:** The project environment and folder path you wish to retrieve secrets from.
   * **Destination:** The App Connection to utilize and the destination endpoint to deploy secrets to. These can vary between services.
   * **Options:** Customize how secrets should be synced, such as whether secrets should be imported from the destination on the initial sync, or whether the sync should [include all subfolders](#include-all-subfolders) beneath the source path.

> [!NOTE]
>
> Secret Syncs are the source of truth for connected third-party services. Any secret,
> including associated data, not present or imported in Infisical before syncing will be
> overwritten, and changes made directly in the connected service outside of infisical may also
> be overwritten by future syncs.

> [!NOTE]
>
> Some third-party services don't support importing secrets.

3. **Utilize Sync:** Any changes to the source location will now automatically be propagated to the destination endpoint.

> [!NOTE]
>
> Infisical is continuously expanding it's Secret Sync third-party service support. If the service you need isn't available,
> you can contact us at [support@infisical.com](mailto:support@infisical.com) to make a request.

## Include all subfolders

A Secret Sync covers only the secrets in its source folder by default. Turn on **Include secrets from all subfolders** on the source step and the sync covers every folder beneath that path as well, however deep. Adding or changing a secret in any of those folders syncs it to the destination, the same as a change in the source folder itself.

Destinations store secrets in one flat list, so the folder structure isn't carried over. A secret named `DB_URL` in `/backend` and a secret named `DB_URL` in `/backend/api` both map to the same destination key, and the sync fails with an error naming both folders rather than picking one. Infisical checks for these collisions while you configure the sync, so you can rename or move one of the two before you save.

```mermaid theme={"dark"}
graph LR
  A[Infisical: **/backend**] --> C[Destination]
  B[Infisical: **/backend/api**] --> C
  style A fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
  style B fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
  style C fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
```

> [!NOTE]
>
> A sync that includes subfolders can't import secrets from the destination into Infisical, because there's no single folder to import them into. Its initial sync behavior is always overwrite destination.

## Key schemas

Key Schemas transform your secret keys by applying a prefix, suffix, or format pattern during sync to external destinations. This makes it clear which secrets are managed by Infisical and prevents accidental changes to unrelated secrets.

Any destination secrets which don't match the schema won't get deleted or updated by Infisical.

Key Schemas use handlebars syntax to define dynamic values. Here's a full list of available variables:

* `{{secretKey}}` - The key of the secret
* `{{environment}}` - The environment which the secret is in (e.g. dev, staging, prod)

**Example:**

* Infisical key: `SECRET_1`
* Schema: `INFISICAL_{{secretKey}}`
* Synced key: `INFISICAL_SECRET_1`

```mermaid theme={"dark"}
graph LR
  A[Infisical: **SECRET_1**] -->|Apply Schema| B[Destination: **INFISICAL_SECRET_1**]
  style B fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
  style A fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
```

> [!NOTE]
>
> When importing secrets from the destination into Infisical, the schema is stripped from imported secret keys.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.