Description

@tadnt2003/n8n-nodes-infisical

An n8n community node for integrating Infisical — the open-source secrets management platform — into your n8n workflows.

> Forked from kennis-ai/n8n-nodes-infisical.
> Credit and thanks to the original author at Kennis AI for the initial implementation.

n8n is a fair-code licensed workflow automation platform.

Installation
Credentials
Operations
Compatibility
Resources

—

Installation

Follow the community nodes installation guide in the n8n documentation.

Package name: @tadnt2003/n8n-nodes-infisical

—

Credentials

The node supports two authentication methods. Universal Auth is strongly recommended — Service Tokens are deprecated by Infisical.

Universal Auth (Machine Identity) — Recommended

Universal Auth uses a Machine Identity’s Client ID and Client Secret to obtain a short-lived access token automatically before each workflow execution.

1. Log in to your Infisical account (Cloud or self-hosted)
2. Go to Organization Settings → Access Control → Machine Identities
3. Create a new Machine Identity
4. Under the identity, add a Universal Auth client secret
5. Assign the identity to your project with appropriate roles
6. Copy the Client ID and Client Secret

Service Token (Legacy)

Service Tokens are deprecated by Infisical and may be removed in future versions. Use Universal Auth for new integrations.

1. Log in to your Infisical account
2. Go to Project Settings → Service Tokens
3. Create a new Service Token with the required permissions
4. Copy the token

> For self-hosted Infisical, set API URL to your instance (e.g., https://infisical.example.com/api).

—

Operations

Secret

All Secret operations require: Project ID, Environment, Secret Path (default: /).

| Operation | Description | Method | API endpoint |
| — | — | — | — |
| Get | Fetch a single secret by key | GET | /v4/secrets/{key} |
| Get Many | List all secrets in a path | GET | /v4/secrets |
| Create | Create a single secret | POST | /v4/secrets/{key} |
| Create Many | Create multiple secrets in one request | POST | /v4/secrets/batch |
| Update | Update a single secret | PATCH | /v4/secrets/{key} |
| Update Many | Update multiple secrets in one request | PATCH | /v4/secrets/batch |
| Delete | Delete a single secret by key | DELETE | /v4/secrets/{key} |
| Delete Many | Delete multiple secrets in one request | DELETE | /v4/secrets/batch |

#### Get

Required: Secret Key

#### Get Many

No extra required fields. Returns each secret as a separate output item.

#### Create

Required: Secret Key, Secret Value

Additional Fields (optional):

| Field | Description |
| — | — |
| Secret Comment | Attach a comment to the secret |
| Skip Multiline Encoding | Disable multiline encoding for the value |
| Type | shared (default) or personal |

Secret Metadata (optional): Add one or more key/value metadata tags to attach to the secret.

#### Create Many

Add secrets using the repeatable Secrets list. Each entry requires Secret Key and Secret Value.

Per-secret optional fields:

| Field | Description |
| — | — |
| Secret Comment | Attach a comment to this secret |
| Skip Multiline Encoding | Disable multiline encoding for this secret’s value |
| Secret Metadata | Key/value metadata tags for this secret |

Additional Fields (optional):

| Field | Description |
| — | — |
| Secret Path Override | Use a different path than the top-level Secret Path for this batch |

Returns each created secret as a separate output item. If a secret protection policy is active, returns an approval object instead.

#### Update

Required: Secret Key (identifies the secret to update)

All update values are optional — set only what needs to change.

Additional Fields (optional):

| Field | Description |
| — | — |
| Secret Value | The new value |
| New Secret Name | Rename the secret to a new key |
| Secret Comment | Update the attached comment |
| Type | shared or personal |
| Skip Multiline Encoding | Disable multiline encoding for the value |

Secret Metadata (optional): Add one or more key/value metadata tags to attach to the secret.

#### Update Many

Add secrets using the repeatable Secrets list. Each entry requires Secret Key (the current name).

Per-secret optional fields:

| Field | Description |
| — | — |
| Secret Value | The new value (leave blank to keep existing) |
| New Secret Name | Rename this secret |
| Secret Comment | Update the comment for this secret |
| Skip Multiline Encoding | Disable multiline encoding for this secret’s value |
| Secret Metadata | Key/value metadata tags for this secret |

Additional Fields (optional):

| Field | Description |
| — | — |
| Mode | failOnNotFound (default) — error if secret missing; upsert — create if missing; ignore — skip missing secrets |
| Secret Path Override | Use a different path than the top-level Secret Path for this batch |

Returns each updated secret as a separate output item. If a secret protection policy is active, returns an approval object instead.

#### Delete

Required: Secret Key

#### Delete Many

Add secrets using the repeatable Secrets list. Each entry requires Secret Key and Type (shared or personal).

Additional Fields (optional):

| Field | Description |
| — | — |
| Secret Path Override | Use a different path than the top-level Secret Path for this batch |

—

Environment

All Environment operations require: Project ID.

| Operation | Description | Method | API endpoint |
| — | — | — | — |
| Create | Create a new environment in a project | POST | /v1/projects/{projectId}/environments |
| Get | Fetch an environment by its ID | GET | /v1/projects/{projectId}/environments/{id} |
| Get by Slug | Fetch an environment by its slug¹ | GET | /v1/projects/{projectId}/environments/slug/{envSlug} |
| Update | Update an environment by ID | PATCH | /v1/projects/{projectId}/environments/{id} |
| Delete | Delete an environment by ID | DELETE | /v1/projects/{projectId}/environments/{id} |
| Restore | Restore a soft-deleted environment by ID¹ | POST | /v1/projects/{projectId}/environments/{id}/restore |

> ¹ Get by Slug and Restore (plus the Hard Delete toggle’s soft-delete behavior) rely on newer Infisical API features. Older self-hosted instances only expose get-by-ID and treat every delete as permanent; on those instances these operations return an error. Use Get (by ID) if Get by Slug is unavailable.

#### Create Environment

Required: Project ID, Environment Name (1–255 characters), Environment Slug (1–64 characters).

Additional Fields (optional):

| Field | Description |
| — | — |
| Position | Display position; the lowest number is shown first |

#### Get Environment

Required: Project ID, Environment ID

#### Get Environment by Slug

Required: Project ID, Environment Slug. Requires a newer Infisical version (see note above).

#### Update Environment

Required: Project ID, Environment ID

Update Fields (optional):

| Field | Description |
| — | — |
| Name | The new display name (1–255 characters) |
| Slug | The new slug (1–64 characters) |
| Position | The new display position; the lowest number is shown first |

#### Delete Environment

Required: Project ID, Environment ID

Additional Fields (optional):

| Field | Description |
| — | — |
| Hard Delete | Permanently delete the environment. If disabled, it is soft-deleted and can be restored. |

#### Restore Environment

Required: Project ID, Environment ID

Restores a previously soft-deleted environment.

—

Project

| Operation | Description | Method | API endpoint |
| — | — | — | — |
| Create | Create a new project | POST | /v1/projects |
| Get | Fetch a project by ID | GET | /v1/projects/{id} |
| Get by Slug | Fetch a project by slug | GET | /v1/projects/slug/{slug} |
| Get Many | List all accessible projects | GET | /v1/projects |
| Get Secret Snapshots | List secret snapshots for a project environment | GET | /v1/projects/{id}/secret-snapshots |
| Get User Memberships | List all user memberships in a project | GET | /v1/projects/{id}/memberships |
| Get User by Username | Fetch a project member by username | POST | /v1/projects/{id}/memberships/details |
| Update | Update a project by ID | PATCH | /v1/projects/{id} |
| Delete | Delete a project by ID | DELETE | /v1/projects/{id} |

#### Create Project

Required: Project Name (max 64 characters).

Additional Fields (optional):

| Field | Description |
| — | — |
| Description | An optional description for the project (max 1024 characters) |
| Slug | A URL-friendly slug for the project (5–64 characters) |
| KMS Key ID | The ID of the KMS key to use for encryption |
| Template | The name of the project template to apply (default: default) |
| Type | Project type: Secret Manager (default), Cert Manager, KMS, SSH, Secret Scanning, PAM, or AI |
| Create Default Environments | Create the default dev, staging, and prod environments (default: on) |
| Delete Protection | Prevent the project from being deleted (default: off) |

#### Get Project

Required: Project ID

#### Get by Slug

Required: Project Slug

#### Get Many Projects

No extra required fields. Returns each project as a separate output item.

#### Get Secret Snapshots

Required: Project ID, Environment

Additional Fields (optional):

| Field | Description |
| — | — |
| Secret Path | Filter snapshots by path (default: /) |
| Offset | Number of results to skip (for pagination) |
| Limit | Maximum number of results to return |

Returns each snapshot as a separate output item.

#### Get User Memberships

Required: Project ID

Returns each membership as a separate output item.

#### Get User by Username

Required: Project ID, Username

#### Update Project

Required: Project ID

Update Fields (optional):

| Field | Description |
| — | — |
| Name | A new name for the project (max 64 characters) |
| Description | A new description for the project (max 1024 characters) |
| Slug | A new slug (max 64 characters, unique within the organization) |
| Auto Capitalization | Enable auto-capitalization of secret keys |
| Delete Protection | Prevent the project from being deleted |
| Secret Sharing | Allow secret sharing in the project |
| PIT Version Limit | Number of point-in-time secret versions to retain (1–100) |

#### Delete Project

Required: Project ID

> Warning: Deleting a project is irreversible and removes all associated data.

—

Folder

All Folder operations except Get Folder by ID require: Project ID, Environment, Folder Path (default: /).

| Operation | Description | Method | API endpoint |
| — | — | — | — |
| Get Folder by ID | Fetch a folder by its ID | GET | /v2/folders/{id} |
| List Folders | List all folders at a path | GET | /v2/folders |
| Create | Create a new folder | POST | /v2/folders |
| Update | Rename or update a folder | PATCH | /v2/folders/{id} |
| Delete | Delete a folder | DELETE | /v2/folders/{id} |

#### Get Folder by ID

Required: Folder ID

#### List Folders

Required: Project ID, Environment, Folder Path

Additional Fields (optional):

| Field | Description |
| — | — |
| Recursive | Return all nested subfolders as well |
| Last Secret Modified | Filter folders by last secret modification time |

Returns each folder as a separate output item.

#### Create Folder

Required: Project ID, Environment, Folder Path (parent path), Folder Name

Additional Fields (optional):

| Field | Description |
| — | — |
| Description | A description for the folder |

#### Update Folder

Required: Project ID, Environment, Folder Path, Folder ID, Folder Name (new name)

Additional Fields (optional):

| Field | Description |
| — | — |
| Description | A description for the folder |

#### Delete Folder

Required: Project ID, Environment, Folder Path, Folder ID or Name

Additional Fields (optional):

| Field | Description |
| — | — |
| Force Delete | Delete the folder even if it contains secrets or subfolders |

—

Secret Import

A secret import links secrets from a source environment/path into a destination environment/path. All Secret Import operations require: Project ID, Environment (destination), Secret Path (destination, default: /).

| Operation | Description | Method | API endpoint |
| — | — | — | — |
| Create | Create a secret import | POST | /v2/secret-imports |
| List | List secret imports at a path | GET | /v2/secret-imports |
| Update | Update a secret import | PATCH | /v2/secret-imports/{id} |
| Delete | Delete a secret import | DELETE | /v2/secret-imports/{id} |

#### Create Secret Import

Required: Project ID, Environment, Import From Environment (source), Import From Path (source).

Additional Fields (optional):

| Field | Description |
| — | — |
| Source Project ID | Import from a different project (defaults to the destination project) |
| Is Replication | Automatically sync new secrets from the source into the destination |

#### List Secret Imports

Required: Project ID, Environment, Secret Path. Returns each import as a separate output item.

#### Update Secret Import

Required: Project ID, Environment, Secret Import ID.

Update Fields (optional):

| Field | Description |
| — | — |
| Import From Environment | The new source environment slug |
| Import From Path | The new source path |
| Position | Display position; the lowest number is shown first |

#### Delete Secret Import

Required: Project ID, Environment, Secret Import ID.

—

Secret Tag

Tags are project-scoped labels that can be attached to secrets. All Secret Tag operations require: Project ID.

> Note: Infisical’s tag endpoints are workspace-scoped (/v1/workspace/{projectId}/tags) — this is the legacy path segment (workspace == project) and is the only documented tags API. It remains functional.

| Operation | Description | Method | API endpoint |
| — | — | — | — |
| Create | Create a tag | POST | /v1/workspace/{projectId}/tags |
| Get | Fetch a tag by ID | GET | /v1/workspace/{projectId}/tags/{tagId} |
| Get by Slug | Fetch a tag by slug | GET | /v1/workspace/{projectId}/tags/slug/{tagSlug} |
| List | List all tags in a project | GET | /v1/workspace/{projectId}/tags |
| Update | Update a tag by ID | PATCH | /v1/workspace/{projectId}/tags/{tagId} |
| Delete | Delete a tag by ID | DELETE | /v1/workspace/{projectId}/tags/{tagId} |

#### Create Tag

Required: Project ID, Tag Slug (1–64 characters), Tag Color (hex code, e.g. #bec2c8).

#### Get Tag

Required: Project ID, Tag ID.

#### Get Tag by Slug

Required: Project ID, Tag Slug.

#### List Tags

Required: Project ID. Returns each tag as a separate output item.

#### Update Tag

Required: Project ID, Tag ID, Tag Slug, Tag Color.

#### Delete Tag

Required: Project ID, Tag ID.

—

InfisicalSync

The InfisicalSync node provides bidirectional sync between n8n credentials and Infisical secrets. It requires an InfisicalApi credential (to authenticate to Infisical) and optionally an n8nApi credential (to read and write n8n credentials via the REST API).

Sync Operations

| Operation | Direction | Description |
| — | — | — |
| Sync to Infisical | n8n → Infisical | Push an n8n credential as a folder of secrets in Infisical. Each field becomes a secret; a n8ncredentialtype metadata tag is attached to every secret for auto-discovery. Supports Form mode (select credential type from a dropdown and fill individual fields) and JSON mode (paste any credential type as a raw JSON object). When an n8nApi credential is configured, the input is validated against the n8n schema before any Infisical write occurs. |
| Sync from Infisical | Infisical → n8n | Pull all secrets from a named Infisical folder and update an existing n8n credential by ID. |
| Auto Sync from Infisical | Infisical → n8n | Discover all subfolders under a root Infisical path, read the n8ncredentialtype metadata tag from each folder’s secrets, then create or update the matching n8n credentials automatically. Uses the n8n REST API and validates credential data against each type’s JSON Schema before saving. |

Both Infisical → n8n operations expose an If Credential Missing option for when the target n8n credential can’t be found (deleted since the last sync, or — for Auto Sync — never created):

• Create New Credential (default) — recreate it using the n8ncredentialtype metadata tag stored on the folder’s secrets.
• Skip — leave n8n untouched and report the item as skipped instead of creating or erroring.

#### OAuth Credential Handling (Auto Sync only)

OAuth1/OAuth2 credentials obtain their access token through an interactive browser consent, stored by n8n in an oauthTokenData field that is not synced. Because updating a credential replaces its stored data, blindly re-syncing an already-connected OAuth credential would wipe its token and force re-authorization. Auto Sync from Infisical therefore exposes an OAuth Credential Handling option:

• Create Only (default) — create OAuth credentials that don’t exist yet, but never update existing ones, so a connected credential’s token is never overwritten. You still authorize each newly created OAuth credential once in n8n.
• Skip — never create or update OAuth credentials; report them as skipped for manual handling.
• Update All — treat OAuth credentials like any other. ⚠️ Under Full Replace update strategy, updating an already-connected OAuth credential clears its saved access token and requires re-authorization. Under Partial Merge (default), the token is preserved.

Non-OAuth credentials are unaffected by this option and always create/update per If Credential Missing.

#### Update Strategy (Sync from / Auto Sync)

Controls how existing n8n credentials are updated when syncing Infisical → n8n:

Both strategies send a complete, schema-valid payload (n8n validates data against the full credential schema before applying it, regardless of the flag). The difference is what happens to fields the sync doesn’t track:

• Partial Merge (default) — sets isPartialData: true so n8n merges the payload into the existing credential. Fields n8n manages but Infisical does not — notably OAuth access tokens (oauthTokenData) — are preserved instead of wiped. Requires a recent n8n version that supports partial credential updates.
• Full Replace — overwrites the entire credential data object. Use for older n8n versions that don’t support partial updates. ⚠️ Wipes fields not included in the sync, including OAuth access tokens (the credential must be re-authorized).

Supported Credential Types (Form Mode)

Form mode supports 75 credential types. JSON mode accepts any type registered in n8n.

#### AI / LLM

anthropicApi, openAiApi, groqApi, cohereApi, huggingFaceApi, mistralCloudApi, googlePalmApi

#### Productivity / Project Management / SaaS

jiraSoftwareCloudApi, airtableTokenApi, notionApi, stripeApi, hubspotAppToken, sendGridApi

#### Messaging / Social

discordBotApi, discordWebhookApi, slackApi, telegramApi, twilioApi, mattermostApi, matrixApi, rocketchatApi, whatsAppApi, facebookGraphApi, pushoverApi

#### Messaging / Social (OAuth2)

slackOAuth2Api, microsoftTeamsOAuth2Api, twitterOAuth2Api, twitterOAuth1Api, linkedInOAuth2Api, discordOAuth2Api

> Note: OAuth2 credentials sync only the app-registration fields (clientId/clientSecret and service-specific config). The oauthTokenData blob from the browser consent flow is not synced — a pulled credential must be re-authorised (one “Connect” click) in the target n8n.

#### SaaS (OAuth2)

salesforceOAuth2Api, hubspotOAuth2Api, dropboxOAuth2Api, spotifyOAuth2Api

> Note: Same pattern as the Messaging/Social OAuth2 group above (clientId/clientSecret only, no oauthTokenData). salesforceOAuth2Api additionally syncs environment (production/sandbox); dropboxOAuth2Api additionally syncs accessType (app folder/full Dropbox). hubspotOAuth2Api and spotifyOAuth2Api have no extra user-editable fields beyond the standard OAuth2 app registration.

#### Source Control

githubApi, githubOAuth2Api, gitlabApi, gitlabOAuth2Api, bitbucketApi, bitbucketAccessTokenApi

#### Google

googleApi, googleOAuth2Api, googleSheetsOAuth2Api, googleDriveOAuth2Api, googleDocsOAuth2Api

#### Databases

mySql, postgres, mongoDb, microsoftSql, redis, crateDb, questDb, timescaleDb, elasticsearchApi, supabaseApi, nocoDb, snowflake

> Note: crateDb/questDb/timescaleDb are Postgres wire-compatible and share its host/database/user/password/port/ssl shape. snowflake supports both password and key-pair authentication via its authentication field.

#### SSH

sshPassword, sshPrivateKey

> Note: These are the standalone SSH credential types — distinct from the SSH-tunnel sub-fields already synced inside mySql/postgres for database connections routed through an SSH tunnel.

#### Email

smtp, imap

> Note: smtp has a conditional disableStartTls field that only applies when secure: false. Neither type has any top-level required field in the live schema.

#### Cloud / Infrastructure

aws, awsAssumeRole

> Note: aws and awsAssumeRole share the same region and custom-endpoint fields (7 VPC endpoint overrides gated by customEndpoints). aws supports temporary STS credentials via temporaryCredentials; awsAssumeRole assumes an IAM role via roleArn/externalId and can source its base credentials from n8n’s own system credentials (useSystemCredentialsForRole) instead of static keys.

#### Infrastructure

n8nApi, infisicalApi

#### Generic HTTP Auth

httpBearerAuth, httpBasicAuth, httpDigestAuth, httpHeaderAuth, httpQueryAuth, httpCustomAuth, httpSslAuth, oAuth1Api, oAuth2Api, jwtAuth

> Note: httpMultipleHeadersAuth is not supported in form mode because its headers field is a fixedCollection that cannot be serialised to flat Infisical key-value secrets. Use JSON mode for that type.

—

API behaviour notes

• All operations use Infisical API v4 for single-secret endpoints (/api/v4/secrets/…) and batch secret endpoints (/api/v4/secrets/batch).
• Project operations use Infisical API v1 (/api/v1/projects/…).
• Folder operations use Infisical API v2 (/api/v2/folders/…).
• When a secret protection policy is active on the project, create/update/delete endpoints return an approval object ({ approval: { id, status, … } }) instead of the secret directly.

—

Compatibility

| Component | Version |
| — | — |
| n8n | v2.21.5 |
| Infisical | Cloud and Community Edition |
| Infisical API | v4 |
| n8n Nodes API | v1 |

—

Resources

• n8n Community Nodes documentation
• Infisical documentation
• Infisical Universal Auth (Machine Identities)
• Infisical API reference
• Original repository — kennis-ai/n8n-nodes-infisical

—

License

MIT