infisical-login

The infisical-login provider enables you to log in to Infisical using OpenID Connect or by providing static credentials. The provider will return a set of credentials that can be used to run Infisical CLI commands using the pulumi env run command and also pull in secrets from Infisical using the infisical-secrets provider.

Example

values:
  infisical:
    login:
      fn::open::infisical-login:
        oidc:
          identityId: aaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
  environmentVariables:
    # Consumed by the Infisical CLI for authentication
    INFISICAL_TOKEN: ${infisical.login.accessToken}

Schema reference

Reference schemas last updated on 2026-07-11, synced automatically from the Pulumi Cloud ESC API.

Inputs

• oidc object optional
  Options for temporary OIDC credentials.
• ↳ identityId string required
  The identity id to use.
• ↳ subjectAttributes array[string] optional
  The attributes used to issue the oidc token subject.
• siteUrl string optional
  The site url to use.
• static object optional
  Options for static credentials.
• ↳ clientId string required
  The client id to use.
• ↳ clientSecret string required
  The client secret to use.

Outputs

• accessToken string required
  The access token to use for authentication.
• siteUrl string optional
  The site url to use.

Configuring OIDC

To learn how to configure OpenID Connect (OIDC) between Pulumi Cloud and Infisical, see the OpenID Connect integration documentation.

Static credentials

To use static credentials instead of OIDC, add a new Auth method on your Infisical Identity and select Universal Auth. Create a new client secret, then supply the clientId and clientSecret from Universal Auth as the provider’s static credentials.