---
title: infisical-login
url: /docs/esc/providers/login/infisical-login/
---


The `infisical-login` provider enables you to log in to Infisical using OpenID Connect or by providing static
credentials. The provider will return a set of credentials that can be used to run Infisical CLI commands using
the [pulumi env run](/docs/iac/cli/commands/pulumi_env_run/) command and also pull in secrets from Infisical using the
`infisical-secrets` provider.

## Example

```yaml
values:
  infisical:
    login:
      fn::open::infisical-login:
        oidc:
          identityId: aaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
  environmentVariables:
    # Consumed by the Infisical CLI for authentication
    INFISICAL_TOKEN: ${infisical.login.accessToken}
```

## Schema reference

  Reference schemas last updated on 2026-09-19, synced automatically from the Pulumi Cloud ESC API.

### Inputs

  
  
  

  

  

<link rel="stylesheet" href="/fingerprinted/css/openapi.bea05c86acadd43e2a68cc78ae738835e6485d9ab355035216617245beeeb307.css">

  
  
  
  

  

  

  

`oidc`
object
optional

Options for temporary OIDC credentials.

  

  

  
  
  
  

  

  

  

↳
`identityId`
string
required

The identity id to use.

  

  

  
  
  
  
  

  
  
  
  

  

  

  

↳
`subjectAttributes`
array[string]
optional

The attributes used to issue the oidc token subject.

  

  

  
  
  
  
  

  

  
  
  
  
  

  
  
  
  

  

  

  

`siteUrl`
string
optional

The site url to use.

  

  

  
  
  
  
  

  
  
  
  

  

  

  

`static`
object
optional

Options for static credentials.

  

  

  
  
  
  

  

  

  

↳
`clientId`
string
required

The client id to use.

  

  

  
  
  
  
  

  
  
  
  

  

  

  

↳
`clientSecret`
string
required

The client secret to use.

  

  

  
  
  
  
  

  

  
  
  
  
  

  

### Outputs

  
  
  

  

  

<link rel="stylesheet" href="/fingerprinted/css/openapi.bea05c86acadd43e2a68cc78ae738835e6485d9ab355035216617245beeeb307.css">

  
  
  
  

  

  

  

`accessToken`
string
required

The access token to use for authentication.

  

  

  
  
  
  
  

  
  
  
  

  

  

  

`siteUrl`
string
optional

The site url to use.

  

  

  
  
  
  
  

  

## Configuring OIDC

To learn how to configure OpenID Connect (OIDC) between Pulumi Cloud and Infisical, see
the [OpenID Connect integration](/docs/esc/guides/configuring-oidc/infisical/) documentation.

## Static credentials

To use static credentials instead of OIDC, add a new Auth method on your Infisical Identity and
select `Universal Auth`. Create a new client secret, then supply the `clientId` and `clientSecret`
from Universal Auth as the provider's static credentials.