infisical-api
Interact with the Infisical REST API to manage secrets, projects, environments, machine identities, and more. Supports secret CRUD operations, machine identity authentication, pagination, and rate limiting on cloud deployments. Not for the CLI/SDKs (infisical-setup), KMS crypto endpoints (infisical-kms), certificate endpoints (infisical-pki), or human SSO login (infisical-sso).
- Installs
- 985
- Last 24h
- +9
- Trending rank
- #9197
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/infisical/ai-skills --skill infisical-api- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads infisical-api automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Infisical API Skill
This skill provides guidance for working with the Infisical REST API. Use it when you need to:
- Authenticate via machine identity Universal Auth
- List, get, create, update, or delete secrets
- Manage projects, environments, and members
- Work with machine identities and identity auth methods
- Handle pagination and understand rate limits
- Choose the correct API version and region
Not this skill
| If the user wants... | Use |
|---|---|
| The CLI, an SDK, or a platform integration | infisical-setup |
| Terraform/HCL | infisical-terraform |
| Human login via SAML/OIDC/LDAP | infisical-sso |
| Roles, permissions, and approval policies | infisical-access-control |
| The KMS encrypt/decrypt/sign endpoints | infisical-kms |
| Certificate endpoints | infisical-pki |
| Secret sync / rotation / App Connection endpoints | the matching product skill |
This skill covers the core secrets, projects, and identities API. Product-specific endpoints are documented in their own skills, where the surrounding concepts live.
Guiding Principles
- Always authenticate via machine identity Universal Auth first — use the Universal Auth login endpoint to obtain a Bearer token before making other API calls
- Use /api/v4/secrets for secret operations — v1/v2/v3 secret endpoints are deprecated
- Use /api/v1/projects, not /api/v1/workspace — workspace endpoints are deprecated
/api/v4/secretsis not paginated — it returns every secret at the requested path in one response and ignoresoffset/limit. Scope results withsecretPath,recursive,tagSlugs, ormetadataFilterinstead. Pagination exists on other collection endpoints (identities, memberships, certificates), which return{ <resource>: [...], totalCount: n }- Region selection — US region: us.infisical.com, EU region: eu.infisical.com
- Service tokens are deprecated — use machine identities instead
- Rate limits apply to self-hosted too — they are not cloud-only. Instance defaults are 60 reads/min, 200 writes/min, 60 secrets-ops/min, 60 auth/min per IP; self-hosted admins can change them, and cloud limits vary by plan. On a 429, honor the
retry-afterheader (seconds remaining, not a timestamp) - Batch over loop — use
POST/PATCH/DELETE /api/v4/secrets/batchrather than per-secret calls; batch delete takessecrets: [{ secretKey }]
Reference Files
- Authentication — Universal Auth login, auth endpoints, token patterns, deprecated service tokens
- Secrets Endpoints — CRUD operations on secrets using /api/v4/secrets
- Projects and Identities — project management, environments, members, identities, groups, folders
- Pagination and Rate Limits — offset/limit pagination, cloud rate limits, content-type requirements
Quick Start
1. Authenticate with Universal Auth
curl -X POST https://us.infisical.com/api/v1/auth/universal-auth/login \
-H "Content-Type: application/json" \
-d '{
"clientId": "YOUR_CLIENT_ID",
"clientSecret": "YOUR_CLIENT_SECRET"
}'
Response:
{
"accessToken": "eyJ...",
"expiresIn": 3600,
"accessTokenMaxTTL": 86400,
"tokenType": "Bearer"
}
2. Use the Token for Subsequent Requests
curl -X GET 'https://us.infisical.com/api/v4/secrets?projectId=PROJECT_ID&environment=dev' \
-H "Authorization: Bearer eyJ..."
Common Workflows
List All Secrets in a Project
Returns every secret at the path — there is no pagination on this endpoint.
curl -X GET 'https://us.infisical.com/api/v4/secrets?projectId=PROJECT_ID&environment=dev' \
-H "Authorization: Bearer TOKEN"
Add recursive=true to include subfolders:
curl -X GET 'https://us.infisical.com/api/v4/secrets?projectId=PROJECT_ID&environment=dev&secretPath=/&recursive=true' \
-H "Authorization: Bearer TOKEN"
Response is { "secrets": [...], "imports": [...] } — no total, offset, or limit keys.
Create a New Secret
curl -X POST 'https://us.infisical.com/api/v4/secrets/MY_SECRET' \
-H "Authorization: Bearer TOKEN" \
-H "Content-Type: application/json" \
-d '{
"projectId": "PROJECT_ID",
"environment": "dev",
"secretPath": "/",
"secretValue": "super-secret-value",
"type": "shared"
}'
Get a Specific Secret
curl -X GET 'https://us.infisical.com/api/v4/secrets/MY_SECRET?projectId=PROJECT_ID&environment=dev&secretPath=/' \
-H "Authorization: Bearer TOKEN"
Update a Secret
curl -X PATCH 'https://us.infisical.com/api/v4/secrets/MY_SECRET' \
-H "Authorization: Bearer TOKEN" \
-H "Content-Type: application/json" \
-d '{
"projectId": "PROJECT_ID",
"environment": "dev",
"secretPath": "/",
"secretValue": "new-value"
}'
Delete a Secret
curl -X DELETE 'https://us.infisical.com/api/v4/secrets/MY_SECRET?projectId=PROJECT_ID&environment=dev&secretPath=/' \
-H "Authorization: Bearer TOKEN"
Important Notes
- Include
Content-Type: application/jsonon any request that carries a JSON body - Tokens expire after
expiresInseconds; implement refresh logic for long-running operations - For self-hosted deployments, replace
us.infisical.comwith your custom domain - Secret operations support all 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE)
viewSecretValuedefaults totrue; set it tofalsewhen you only need key names- The
recursiveparameter on list secrets includes secrets in all subdirectories - Beyond CRUD,
/api/v4/secretsalso exposes/move,/duplicate,/batch(POST, PATCH, DELETE),/id/:secretId, and secret-reference tree endpoints
FAQ
What does the infisical-api skill do?
Interact with the Infisical REST API to manage secrets, projects, environments, machine identities, and more. Supports secret CRUD operations, machine identity authentication, pagination, and rate limiting on cloud deployments. Not for the CLI/SDKs (infisical-setup), KMS crypto endpoints (infisical-kms), certificate endpoints (infisical-pki), or human SSO login (infisical-sso).
How do I install infisical-api?
Run npx skills add https://github.com/infisical/ai-skills --skill infisical-api in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/infisical-api/ (personal) or .claude/skills/infisical-api/ (project).
Which AI agents can use infisical-api?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is infisical-api safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains infisical-api?
It is published by infisical in infisical/ai-skills. It has 985 recorded installs.
More from infisical/ai-skills
infisical-secret-syncs
infisical/ai-skills
Guide for configuring Infisical Secret Syncs to push secrets from Infisical to third-party services. Covers all 48 sync destinations including AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub, Vercel, HashiCorp Vault, Cloudflare, Snowflake, Databricks, Railway, and more. Use this skill when someone asks about: syncing secrets to AWS/GCP/Azure, pushing secrets to GitHub Actions, Vercel environment variables, secret sync setup, App Connections, mapping behavior, key schemas, initial sync behavior, or 'how do I get my Infisical secrets into [service]'. Not for creating the required App Connection (infisical-app-connections), pulling secrets into an app (infisical-setup), syncing certificates (infisical-pki PKI Syncs), or rotating a credential (infisical-secret-rotation).
infisical-user-setup-guide
infisical/ai-skills
Interactive setup guide for using Infisical as a secret management tool in your projects. Helps users integrate Infisical into local development (CLI), Docker containers (build-time and runtime secret injection), CI/CD pipelines (GitHub Actions, GitLab CI), Kubernetes (Operator + CRDs), and application code (all 9 SDKs: Node.js, Python, Go, Java, .NET, Ruby, PHP, Rust, C++). Also walks through choosing and configuring any of the 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE). Use this skill whenever someone asks about: using Infisical, injecting secrets, infisical run, infisical init, connecting their app to Infisical, Docker secrets, Kubernetes secrets operator, machine identity setup, SDK initialization, CI/CD secret injection, or 'how do I get my secrets into my app'. Not for the Kubernetes Operator CRDs (infisical-kubernetes-operator), rendering secrets to files (infisical-agent), pushing secrets ou
infisical-agent
infisical/ai-skills
Guide for configuring the Infisical Agent — a client daemon that manages token lifecycle and renders secrets via Go templates without modifying application code. Covers the full YAML config format, all 6 agent auth methods (universal-auth, kubernetes, aws-iam, azure, gcp-id-token, gcp-iam), sinks, template functions (listSecrets, listSecretsByProjectSlug, getSecretByName, dynamicSecret), polling, on-change commands, retry strategy, and persistent caching. Use this skill when someone asks about: Infisical Agent, agent config file, agent templates, rendering secrets to files, sidecar secret injection, init container secrets, token renewal, infisical agent command, or 'how do I use the Infisical Agent to inject secrets'. Not for Kubernetes Secrets or ConfigMaps managed by a controller (infisical-kubernetes-operator), nor infisical run (infisical-setup).
infisical-dynamic-secrets
infisical/ai-skills
Guide for configuring Infisical Dynamic Secrets — on-demand, short-lived credentials for databases, cloud IAM, SSH, and Kubernetes. Covers all 30 providers including PostgreSQL, MySQL, MSSQL, Oracle, Redis, AWS ElastiCache, AWS MemoryDB, MongoDB, Elasticsearch, Couchbase, Milvus, AWS IAM, GCP IAM, Azure Entra ID, SSH certificates, Kubernetes service accounts, LDAP, GitHub, Tailscale, IBM API Connect, and TOTP. Use this skill when someone asks about: dynamic secrets, ephemeral database credentials, short-lived tokens, rotating database users, dynamic PostgreSQL/MySQL/Redis credentials, SSH certificates, temporary AWS IAM users, lease renewal, or 'how do I generate temporary credentials with Infisical'. For brand-new short-lived credentials created per request. Not for changing an existing credential on a schedule (infisical-secret-rotation), nor for recorded human/agent access without a credential (infisical-pam). Covers SSH certificates; TLS certificates are infisical-pki.
infisical-self-host
infisical/ai-skills
Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTIONKEY management, PostgreSQL setup, Redis configuration (including the required noeviction policy), production hardening, FIPS 140-3 compliance, scaling, and high availability patterns. For deploying the Infisical platform itself. Not for the Kubernetes Operator, which is a separate Helm chart (infisical-kubernetes-operator), nor for using Infisical once running (infisical-setup).
infisical-terraform
infisical/ai-skills
Expert guidance for the Infisical Terraform Provider. Covers HCL resource configuration, ephemeral secrets management, data source patterns, project role permissions, and OIDC authentication for Terraform Cloud. Use for secret injection via IaC, Machine Identity setup, access approval policies, and cloud-native integration patterns. Not for getting secrets into a running app (infisical-setup) or raw REST calls (infisical-api).
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.