Infisical

Import secrets from an Infisical Cloud folder. One way only: penv never writes back.

The connection

What	This provider
Vendor	Infisical
Key	`infisical-secrets`
Availability	`available`. You can connect it today.
Credential penv holds	`infisical-identity`
Values read back	yes
Activation	`immediate`

Direction	What it does
`import`	Reads names and values out of the store into penv.

Direction	Policies you can pick
`import`	`skip_existing`, `new_version`, `fail`

How syncs work says what each one does.

You paste a credential you already hold. penv seals it and never shows it again.

Field	Label	Kind	Required	What it is
`clientId`	Client ID	secret, masked here and sealed	yes
`clientSecret`	Client Secret	secret, masked here and sealed	yes	From a machine identity with Universal Auth. penv exchanges these for a short-lived token and never stores one.

Fixed when you connect, and shared by every mapping on it.

Field	Label	Kind	Required	Advanced	What it is
`region`	Region	choice	yes	yes	Which Infisical Cloud region holds the project. One of United States, Europe. Starts at `us`.

Answered once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`projectId`	Project ID	text	yes	no	From the project's URL in Infisical.
`environment`	Environment	text	yes	no	The environment slug to read from.
`secretPath`	Folder	text	no	yes	One folder per sync. Subfolders are not walked, so two of them can hold the same name. Starts at `/`.

penv probes for these when it verifies the connection.

Permission	Directions	Blocking	Without it
`identity:login`	every direction	yes	The machine identity cannot mint a token, so nothing can be read.
`secrets:read`	`import`	yes	Import cannot read any values.