> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Create a machine identity, authenticate with Universal Auth, and make your first request to the Infisical API.

This quickstart creates a machine identity with Universal Auth credentials and uses those credentials to make an authenticated request to the Infisical API.

> [!NOTE]
>
> This quickstart uses [Universal Auth](https://infisical.com/docs/documentation/platform/identities/universal-auth.md). For the full list of authentication methods and when to pick each one, see [Authentication](https://infisical.com/docs/api-reference/overview/authentication.md).

## Prerequisites

* The [Admin role](https://infisical.com/docs/documentation/platform/access-controls/role-based-access-controls.md) on either your Infisical organization or a project in the organization

## Step 1: Create a machine identity

You can create a machine identity at the organization level or scoped to a single project. The rest of the quickstart works the same either way.

**Organization-level**

**Step 1**

In your organization, go to **Access Control** > **Machine Identities**, then select **Create**.

**Step 2**

Enter a **Name** for the identity, pick an organization **Role** (**Admin** or **Member** are both fine for this guide), and select **Create**.

**Project-level**

**Step 1**

Open the project, go to **Access Control** > **Machine Identities**, then select **Add Machine Identity to Project**.

**Step 2**

On the **Create New** tab, enter a **Name**, pick a project **Role**, and select **Create**.

This creates the identity with Universal Auth enabled by default and opens the identity's details page.

## Step 2: Generate a client secret

Universal Auth uses a **Client ID** and **Client Secret** pair. Infisical creates the Client ID with the identity but issues each Client Secret on demand.

**Step 1**

On the identity's details page, in the **Authentication** card, select the **Universal Auth** row.

**Step 2**

In the sheet that opens, copy the **Client ID**.

**Step 3**

Select **Add Client Secret**, then **Create** to generate a new secret.

> [!WARNING]
>
> Infisical shows the Client Secret only once. Copy it now and store it somewhere safe before closing the dialog.

## Step 3: Exchange the credentials for an access token

Call [the login endpoint for Universal Auth](https://infisical.com/docs/api-reference/endpoints/universal-auth/login.md) with the Client ID and Client Secret in the request body:

```bash theme={"dark"}
curl -X POST https://app.infisical.com/api/v1/auth/universal-auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "<your-client-id>",
    "clientSecret": "<your-client-secret>"
  }'
```

The response contains the access token, the token's remaining lifetime in seconds (`expiresIn`), and the maximum lifetime the token can reach with renewals (`accessTokenMaxTTL`):

```json theme={"dark"}
{
  "accessToken": "st.xxxxxxxxxxxxxxxxxxxxxxxx",
  "expiresIn": 7200,
  "accessTokenMaxTTL": 43200,
  "tokenType": "Bearer"
}
```

## Step 4: Call the API with the access token

Include the access token as an `Authorization: Bearer` header on every request. For example, to [look up the identity's own details](https://infisical.com/docs/api-reference/endpoints/identities/details.md):

```bash theme={"dark"}
curl https://app.infisical.com/api/v1/identities/details \
  -H "Authorization: Bearer <your-access-token>"
```

The response returns the organization the identity belongs to:

```json theme={"dark"}
{
  "identityDetails": {
    "organization": {
      "id": "...",
      "name": "...",
      "slug": "..."
    }
  }
}
```

Every endpoint in this reference accepts the same `Authorization` header format.

> [!TIP]
>
> You can now make authenticated calls to the Infisical API.

## Next steps

To call an endpoint that operates on a project's resources (for example, reading secrets, issuing certificates, or managing PAM resources), the identity needs to be a member of that project.

If you create the machine identity at the organization-level, it needs to be added to each project you want it to reach. You can do this from **Access Control** > **Machine Identities** inside the project itself.

For more information, check out the machine identity docs:

> **[Machine identities](https://infisical.com/docs/documentation/platform/identities/machine-identities.md)**
>
> How machine identities work, including scopes, project membership, roles, credential rotation, and alerts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.