Skip to content

Infisical

Infisical keeps secrets in projects, split into environments with folders inside each. Infisical.Secrets downloads one folder, with secret references expanded on the server, into the stack’s secret providers. It works exactly like Doppler; this page covers only what differs.

import * as Infisical from "alchemy/Infisical";


secrets: [
  Infisical.Secrets(({ stage }) => ({
    project: "my-app",
    environment: stage === "prod" ? "prod" : "dev",
    path: "/api",
  })),
],

project is the project’s slug, or its id with a user token, since Infisical only resolves slugs for machine identities. environment is the environment slug. Optional path, recursive, and includeImports narrow or widen what is read; imports are on by default and a secret defined directly in the folder wins over an imported one.

Connect your account

Section titled “Connect your account”

Alchemy authenticates with an Infisical machine identity or user token. Create a machine identity for yourself with Universal Auth, read access to your dev project, and a client secret. Then run alchemy profile edit --add Infisical and choose Machine identity; every command afterwards exchanges it for a fresh access token. The client secret remains subject to its configured expiry and use limits. User token takes the ten-day token from the dashboard’s account menu instead. Both accept an API URL for the EU cloud or a self-hosted instance.

Terminal window
alchemy profile edit --add Infisical --method universal-auth \
  --set clientId=env:INFISICAL_CLIENT_ID \
  --set clientSecret=env:INFISICAL_CLIENT_SECRET

In CI

Section titled “In CI”

Set INFISICAL_TOKEN to a ready access token, or INFISICAL_IDENTITY_ID to a machine identity whose OIDC auth trusts your platform:

jobs:
  deploy:
    permissions:
      id-token: write   # lets the job request an OIDC token
      contents: read
    steps:
      - run: bun alchemy deploy --stage prod --yes
        env:
          INFISICAL_IDENTITY_ID: ${{ vars.INFISICAL_IDENTITY_ID }}

Platform detection, precedence, and the INFISICAL_OIDC_TOKEN and INFISICAL_OIDC_AUDIENCE overrides match Doppler’s. INFISICAL_API_URL selects the EU cloud or a self-hosted instance in either mode.

Where next

Section titled “Where next”