How to migrate from Infisical

Create a machine identity

Sink authenticates with Infisical's universal auth: a client ID and a client secret exchanged for a short-lived access token. In your Infisical organisation settings, create a machine identity, enable universal auth, and give it read access to the project you are migrating. Note the client ID and client secret.

Pick the right region while you are there. Infisical Cloud runs in the US and the EU, and an identity exists in one of them. Sink takes us or eu rather than a URL — a free-form host would make the server fetch whatever address it was handed, which is not a thing a secret manager should do. Self-hosted Infisical is not supported for that reason.

Run the import

sink login
sink init                          # writes .sink.json — ids only, safe to commit

export SINK_INFISICAL_CLIENT_ID=...
export SINK_INFISICAL_CLIENT_SECRET=...
export SINK_INFISICAL_REGION=eu          # defaults to us

sink import infisical production --dry-run

The CLI lists the projects the identity can see and the environments in each, and prompts through them. To pin the selection instead:

sink import infisical production \
  --project my-project \
  --provider-env prod \
  --scope path=/backend

path is the folder to read and defaults to the project root. Imported secrets are followed, so what Sink stores matches what your application would actually have resolved at runtime — not just what is literally in that folder.

What to expect

• Infisical keys are already environment variable names, so nothing is renamed.
• One environment at a time — run the import once per Infisical environment.
• Existing keys are skipped unless you pass --mode overwrite, which mints a new version rather than discarding the previous value.
• Folders are not recursive: import each path you care about.

Saving the identity

For a one-off migration, use the environment variables above and delete the machine identity afterwards. If you will keep importing, a workspace admin can store it:

sink connections add infisical "Infisical prod" --scope path=/backend
sink import --connection "Infisical prod" production

The credential is verified against Infisical before it is saved, encrypted at rest with the same envelope scheme as your secrets, and never returned by any endpoint. Revoke it from Settings › Connections. Keep the identity read-only.