Authenticate an Infisical Machine Identity via Universal Auth to obtain a short-lived API access token

Documented steps

1. In the Infisical dashboard go to Organization Settings > Access Control > Identities > Create identity, name it, and assign an organization role. Universal Auth is the default auth method.
2. Open the identity's Universal Auth Configuration and review Access Token TTL (default 2592000s), Access Token Max TTL (default 2592000s), Access Token Max Uses (default 0 = unlimited), and optionally an Access Token Period for periodic tokens.
3. Click Create Client Secret. Optional TTL defaults to 0 (never expires) and Max Uses defaults to 0 (unlimited). Copy the Client Secret immediately - it is shown once - along with the identity's Client ID.
4. Add the identity to the target project: Project > Settings > Access Control > Machine Identities > Add identity, and assign a project role granting the needed secret permissions.
5. Log in: curl --location --request POST 'https://app.infisical.com/api/v1/auth/universal-auth/login' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'clientId=<CLIENT_ID>' --data-urlencode 'clientSecret=<CLIENT_SECRET>'
6. For EU Cloud use https://eu.infisical.com, for self-hosted use your own instance URL.
7. Parse the JSON response for accessToken, tokenType (Bearer), expiresIn and accessTokenMaxTTL.
8. Send the token on subsequent calls as 'Authorization: Bearer <accessToken>'.
9. If the identity is configured with an Access Token Period (periodic token), renew before expiry with POST /api/v1/auth/universal-auth/renew rather than re-logging in.
10. Official docs (verified 2026-07-29): https://infisical.com/docs/documentation/platform/identities/universal-auth | https://infisical.com/docs/documentation/platform/identities/machine-identities | https://infisical.com/docs/api-reference/overview/introduction