> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-mcp-bridge-private-server.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up an Infisical connector

> C1 provides identity governance for Infisical. Integrate your Infisical organization with C1 for unified visibility and governance over user access.

C1 provides identity governance for Infisical. Integrate your Infisical
organization with C1 for unified visibility and governance over user access.

## Capabilities

| Resource      | Sync                                                          | Provision |
| ------------- | ------------------------------------------------------------- | --------- |
| Users         | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Organizations | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Projects      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |

The connector reads one Infisical organization — the organization the
Machine Identity belongs to. It syncs the organization's users (including
pending invitations, which sync as disabled until accepted), the
organization's projects, and the membership grants that connect users to
their organization and to each project. The organization ID is discovered
automatically from the projects the identity can see, so it never has to be
configured.

## Gather Infisical credentials

<Warning>
  You need administrator access to your Infisical organization to create a
  Machine Identity and grant it read access.
</Warning>

<Steps>
  <Step>
    Sign in to Infisical and open **Organization Access Control** >
    **Identities**.
  </Step>

  <Step>
    Create a **Machine Identity** and attach the **Universal Auth**
    authentication method to it.
  </Step>

  <Step>
    Give the identity organization and project read access (for example the
    **Member** organization role, plus membership of the projects you want
    to sync) so it can list members.
  </Step>

  <Step>
    Copy the Universal Auth **Client ID** and **Client Secret**. The secret
    is shown only at creation time.
  </Step>
</Steps>

## Configure the Infisical connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Infisical** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Infisical connector.
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Infisical credentials:

        * **Machine Identity client ID**: the Universal Auth client ID you
          copied.
        * **Machine Identity client secret**: the Universal Auth client
          secret paired with the client ID.
        * **Infisical base URL**: `https://app.infisical.com` for Infisical
          Cloud (US region), `https://eu.infisical.com` for the EU region,
          or your self-hosted instance URL, with no trailing slash.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Infisical connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the Infisical connector in your own
    environment.

    <Steps>
      <Step>
        Create a secret for the Infisical Machine Identity client secret.
      </Step>

      <Step>
        Configure the connector environment variables:

        * **BATON\_INFISICAL\_CLIENT\_ID**: the Universal Auth client ID you
          copied.
        * **BATON\_INFISICAL\_CLIENT\_SECRET**: the Universal Auth client
          secret paired with the client ID.
        * **BATON\_INFISICAL\_BASE\_URL**: `https://app.infisical.com` for
          Infisical Cloud (US region), `https://eu.infisical.com` for the
          EU region, or your self-hosted instance URL, with no trailing
          slash.
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your Infisical connector is now pulling access data into C1.
  </Tab>
</Tabs>