# Infisical Provider

> Manage secrets with Infisical using Pulumi

The Infisical provider enables you to manage secrets, projects, and access controls in Infisical using Pulumi. This provider is dynamically bridged from the [Terraform Infisical Provider](https://registry.terraform.io/providers/Infisical/infisical).

## Installation

Install the Infisical provider package using your preferred package manager:

<Tabs>
  <Tab title="bun">
    ```bash
    bun add pulumi-infisical
    ```
  </Tab>
  <Tab title="pnpm">
    ```bash
    pnpm add pulumi-infisical
    ```
  </Tab>
  <Tab title="yarn">
    ```bash
    yarn add pulumi-infisical
    ```
  </Tab>
  <Tab title="npm">
    ```bash
    npm install pulumi-infisical
    ```
  </Tab>
</Tabs>

## Configuration

### Getting Service Token

1. Log in to Infisical at [app.infisical.com](https://app.infisical.com)
2. Navigate to your project → Settings → Service Tokens
3. Create a new service token
4. Copy the token value

### Provider Setup

```bash
pulumi config set infisical:token YOUR_SERVICE_TOKEN --secret
```

Or using environment variables:

```bash
export INFISICAL_TOKEN="your-service-token"
```

### Self-Hosted Infisical

If you're using a self-hosted Infisical instance, configure the custom host URL:

```bash
pulumi config set infisical:hostUrl https://infisical.your-domain.com
```

Or using environment variables:

```bash
export INFISICAL_HOST_URL="https://infisical.your-domain.com"
```

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as infisical from "pulumi-infisical";

// Configure provider for self-hosted instance
const provider = new infisical.Provider("self-hosted", {
    hostUrl: "https://infisical.your-domain.com",
    token: config.requireSecret("token"),
});

// Use the provider
const project = new infisical.Project("project", {
    name: "Backend Service",
    slug: "backend-service",
}, { provider });
```

## Quick Start

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as infisical from "pulumi-infisical";

// Create a project
const project = new infisical.Project("api-project", {
    name: "API Service",
    slug: "api-service",
});

// Create a secret
const secret = new infisical.Secret("api-key", {
    projectId: project.id,
    environment: "production",
    key: "API_KEY",
    value: "super-secret-value",
});

export const projectId = project.id;
```

## Key Features

### Project Management

```typescript
const project = new infisical.Project("backend-project", {
    name: "Backend Service",
    slug: "backend-service",
});
```

### Secret Management

```typescript
const secret = new infisical.Secret("database-password", {
    projectId: project.id,
    environment: "production",
    key: "DATABASE_PASSWORD",
    value: dbPassword,
    type: "shared",
});
```

### Identity Management

```typescript
const identity = new infisical.Identity("api-identity", {
    name: "API Service",
    roleSlug: "developer",
    projectId: project.id,
});
```