> ## Documentation Index
> Fetch the complete documentation index at: https://www.towbar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Infisical

> Use a scoped Infisical machine identity to resolve deployment secrets.

Towbar can load runtime secrets for an app, resource, or Compose project from an Infisical folder when a deployment runs. The machine identity credentials stay in `/etc/towbar/towbar.yml`. See [External secrets](/docs/secrets/external) for workload manifest examples and folder behavior.

## Prepare access

Create a machine identity in Infisical, grant it access only to the projects, environments, paths, and secret versions your workloads need, and create a client ID and secret for that identity. For a self-hosted Infisical installation, use its HTTPS base URL. Enable `allowPrivateNetwork` only if that installation intentionally resolves to an internal address reachable from Towbar.

```yaml title="/etc/towbar/towbar.yml" theme={"system"}
integrations:
  infisical:
    enabled: true
    baseUrl: https://app.infisical.com
    allowPrivateNetwork: false
    clientId: "<machine-identity-client-id>"
    clientSecret: "<machine-identity-client-secret>"
```

Run `sudo towbar config validate` and `sudo towbar restart`. Confirm that Infisical appears under **Manage → Integrations → External secrets**. This proves the local configuration is valid; a deployment that references a test secret verifies the remote permissions.

## Verify access

Grant the machine identity read access to the intended project, environment, and path. Configure a non-production workload using the [external-secret source guide](/docs/secrets/external), then deploy it to verify remote authorization. The integration's configured indicator only verifies Towbar's local configuration.

If resolution fails, check the deployment's secret stage, path, identity permissions, network reachability, and secret version. Rotate the client secret in YAML, restart Towbar, and deploy a test reference before revoking the old credential.

<div className="towbar-doc-screenshot">
  <div className="towbar-product-light">
    <img src="https://mintcdn.com/avgeek/EgLPXnoUAEgajpP9/assets/release-v2/infisical-setup-light.jpg?fit=max&auto=format&n=EgLPXnoUAEgajpP9&q=85&s=6984d42c84f0d3fbfc4a201bb0ccf3ca" alt="Infisical integration settings in Towbar." width="2560" height="1440" loading="lazy" data-path="assets/release-v2/infisical-setup-light.jpg" />
  </div>

  <div className="towbar-product-dark">
    <img src="https://mintcdn.com/avgeek/EgLPXnoUAEgajpP9/assets/release-v2/infisical-setup-dark.jpg?fit=max&auto=format&n=EgLPXnoUAEgajpP9&q=85&s=875ceb4da348d0ebbea0c9e1eca2ffde" alt="Infisical integration settings in Towbar." width="2560" height="1440" loading="lazy" data-path="assets/release-v2/infisical-setup-dark.jpg" />
  </div>

  <p>
    The Infisical page confirms that Towbar loaded the runtime configuration;
    test a reference to verify remote access.
  </p>
</div>