Skip to main content
Replicas integrates with Infisical to sync secrets from your Infisical projects directly into workspace environment variables. Connections are configured per environment, so you can connect different Infisical projects or environments to your Global environment and to any named environment.

​
Setup

Only organization admins can connect Infisical.
  1. In Infisical, create a Machine Identity with Universal Auth enabled
  2. Add the identity to your target project with read access to the desired environment
  3. Generate a Client ID and Client Secret for the identity
  4. Go to Environments in the Replicas sidebar
  5. Pick the environment you want to connect (Global or any named environment)
  6. Open the Variables tab, scroll to the Integrations section, and click Connect Infisical, then fill in:
    • Client ID and Client Secret from your Machine Identity
    • Project ID: found in your Infisical project settings
    • Environment: the environment slug to pull secrets from (e.g., dev, staging, prod)
    • Secret Path: the folder path within the environment (defaults to /)
    • Site URL: only needed for EU Cloud (https://eu.infisical.com) or self-hosted instances (defaults to US Cloud)
  7. Click Save & Connect. Replicas validates the credentials before saving
You can connect Infisical independently in each environment. For example, you might sync staging secrets in Global and production secrets in an environment bound to a specific repository.

​
How It Works

When a workspace is created, Replicas authenticates with Infisical using the stored Machine Identity credentials for the workspace’s environment (and Global, if configured), fetches all secrets, and injects them as environment variables into the workspace. Connected workspaces also include the Infisical CLI and its project configuration automatically. Run commands such as infisical secrets or infisical run -- <command> without logging in or running infisical init. Replicas gives the CLI a short-lived access token and refreshes it in the background. The Machine Identity Client ID and Client Secret remain on Replicas servers and are never copied into the workspace. If both Global and a more specific environment have Infisical connections, environment variable injection merges secrets from both, while the CLI uses only the more specific connection’s project and environment.

​
Priority

Infisical secrets follow the same priority ordering as manual environment variables, but within each environment, manual variables always override Infisical secrets:
  1. Global Infisical secrets (lowest)
  2. Global manual environment variables
  3. Target environment Infisical secrets
  4. Target environment manual environment variables (highest)
If you define a variable manually in the same environment with the same key as an Infisical secret, the manual value wins. A target-environment Infisical secret overrides a Global manual variable.

​
Test Sync

After connecting, use the Test Sync button to verify that Replicas can reach your Infisical project and see which secret keys are available. Secret values are never displayed; only the key names are shown.

​
Reconfiguring

Click Reconfigure to update the Machine Identity credentials, change the project/environment, or switch the secret path. The new credentials are validated before saving.

​
Copying or Moving Between Environments

Once an Infisical connection is configured in any environment, admins can copy or move it to another environment without re-entering credentials. From the connected environment, open the Copy to or Move to menu next to the connection to choose a target environment.
  • Copy to duplicates the connection to the target environment. Both environments end up with the same Machine Identity, project, environment, and secret path. The source environment keeps its connection.
  • Move to copies to the target and then removes the connection from the source environment.
Credentials are re-encrypted server-side when cloned; the Client Secret is never exposed to the browser during this operation. Only organization admins can copy or move connections.

​
Disconnecting

Click Disconnect to remove the Infisical connection from that environment. Existing environment variables remain unchanged, but CLI authentication is removed from running workspaces during background refresh. New workspaces in that environment no longer receive Infisical secrets or automatic CLI authentication.