# Portainer app connection + secret sync (PR #7670) **URL:** \ **Category:** Contributing\ **Created:** [October 4, 2026, 4:50am UTC](https://community.infisical.com/t/portainer-app-connection-secret-sync-pr-7670/64 "2026-10-04T04:50:29Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![zenato](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/zenato/32/95_2.png) [@zenato](https://community.infisical.com/u/zenato)\ **Post date:** [October 4, 2026, 4:50am UTC](https://community.infisical.com/t/portainer-app-connection-secret-sync-pr-7670/64/1 "2026-10-04T04:50:30Z")
Hey, Ashwin pointed me here from Slack, so posting my PR here instead. > > > \## Context > > Adds Portainer as an app connection and secret sync destination. S…ecrets get synced into a stack's environment variables. > > This was requested in #1281 a while back but got closed, the blocker at the time was that Infisical Cloud can't reach a self hosted Portainer instance. Gateways cover that now, and self hosted Infisical can reach it directly anyway. > > One thing worth calling out: git-based stacks are updated through the stack's git config endpoint, so syncing doesn't redeploy anything - the new values just apply on the stack's next deployment. File based stacks do redeploy because the Portainer API wants the compose file resubmitted on every update. The stack picker in the wizard shows a hint about which case applies. > > \## Screenshots > \portainer-secret-sync-demo > > \## Steps to verify the change > > \- run a Portainer instance (I tested against portainer-ce 2.44.0) and create an api token under My account -\> Access tokens > \- create a Portainer app connection with the instance url and the token > \- create a Portainer secret sync, pick an environment and a stack, let it sync > \- check the stack's env vars in Portainer. for a git stack the running containers should be untouched and the stack's git settings (branch, auto update) preserved > > \## Type > > \- \[\] Fix > \- \[x\] Feature > \- \[\] Improvement > \- \[\] Breaking > \- \[\] Docs > \- \[\] Chore > > \## Checklist > > \- \[x\] Title follows the \[conventional commit\](https://www.conventionalcommits.org/en/v1.0.0/#summary) format: \`type(scope): short description\` (scope is optional, e.g., \`fix: prevent crash on sync\` or \`fix(api): handle null response\`). > \- \[x\] Tested locally > \- \[x\] Updated docs (if needed) > \- \[\] Updated CLAUDE.md files (if needed) > \- \[x\] Read the \[contributing guide\](https://infisical.com/docs/contributing/getting-started/overview) It adds Portainer as an app connection and a secret sync destination. Secrets get written into a stack’s env vars. Someone asked for this back in 2024 ([Portainer integration · Issue #1281 · Infisical/infisical · GitHub](https://github.com/Infisical/infisical/issues/1281)) and it got closed because Cloud couldn’t reach a self-hosted Portainer, which gateways cover now. It’s been open since Aug 15. Rebased it on main again today, fixed the conflicts and moved it over to the new sync payload API. Type check, lint and the docs linter pass locally and the CLA is signed. Also the GitHub workflows on it have never run, they’re all stuck at “action required”, so if someone could approve those that’d be great. If it helps with testing, Portainer CE runs as a single container and I can write up a quick setup. Thanks! ---
**Author:** ![Jake-Infisical](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/jake-infisical/32/40_2.png) [@Jake-Infisical](https://community.infisical.com/u/Jake-Infisical)\ **Post date:** [October 5, 2026, 2:19pm UTC](https://community.infisical.com/t/portainer-app-connection-secret-sync-pr-7670/64/2 "2026-10-05T14:19:30Z")
Hey Zenato! Thanks for this! I will flag this to the team and keep you posted. Thanks, Jake ---
**Author:** ![Victor\_Santos](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/victor_santos/32/119_2.png) [@Victor\_Santos](https://community.infisical.com/u/Victor_Santos)\ **Post date:** [October 13, 2026, 8:46pm UTC](https://community.infisical.com/t/portainer-app-connection-secret-sync-pr-7670/64/3 "2026-10-13T20:46:12Z")
Hey @zenato! I just reviewed your PR and left some comments. ---
**Author:** ![Victor\_Santos](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/victor_santos/32/119_2.png) [@Victor\_Santos](https://community.infisical.com/u/Victor_Santos)\ **Post date:** [October 15, 2026, 7:16pm UTC](https://community.infisical.com/t/portainer-app-connection-secret-sync-pr-7670/64/4 "2026-10-15T19:16:43Z")
Hey @zenato, this was merged in and deployed to Infisical Cloud. If you’re self-hosting, you can use this image version: [v0.166.8](https://hub.docker.com/layers/infisical/infisical/v0.166.8/images/sha256-c4932f3ed45df3193dd67b02ecd41a72f057c6eda882c76d2679ffecb83138fd) Thank you for your contribution!! ---
**Author:** ![zenato](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/zenato/32/95_2.png) [@zenato](https://community.infisical.com/u/zenato)\ **Post date:** [October 15, 2026, 10:20pm UTC](https://community.infisical.com/t/portainer-app-connection-secret-sync-pr-7670/64/5 "2026-10-15T22:20:54Z")
Thanks @Victor_Santos for the detailed review, and thanks @Jake-Infisical for getting this in front of the team. Glad to see it shipped!