Overview

Infisical is an open-source secrets management platform — a centralized place to store, sync, and rotate secrets (API keys, database URLs, tokens) across your team and infrastructure. Instead of .env files scattered across repos and Slack messages with passwords, Infisical stores secrets encrypted, syncs them to environments, injects them into CI/CD, and rotates them automatically.

When to Use

Team sharing secrets via Slack/email (insecure)
.env files in repos or shared drives
Need secrets in CI/CD without hardcoding
Rotating API keys and database passwords
Multi-environment config (dev/staging/prod)
Compliance requirement for secrets audit trail

Instructions

Setup

bash

# Install CLI
npm install -g @infisical/cli

# Or self-host
docker compose up -d  # From infisical/infisical repo

# Login
infisical login

Store and Retrieve Secrets

bash

# Initialize in your project
infisical init

# Push secrets from .env file
infisical secrets set DATABASE_URL="postgresql://..." API_KEY="sk-..."

# List secrets
infisical secrets list --env=dev

# Run your app with injected secrets
infisical run -- npm start
# ^ Injects all secrets as environment variables

# Run with specific environment
infisical run --env=production -- node server.js

SDK Usage

typescript

// config.ts — Fetch secrets programmatically
import { InfisicalClient } from "@infisical/sdk";

const infisical = new InfisicalClient({
  clientId: process.env.INFISICAL_CLIENT_ID,
  clientSecret: process.env.INFISICAL_CLIENT_SECRET,
  siteUrl: "https://infisical.mycompany.com", // Self-hosted URL
});

// Get all secrets for an environment
const secrets = await infisical.listSecrets({
  environment: "production",
  projectId: "proj_xxx",
  path: "/",
});

// Get a specific secret
const dbUrl = await infisical.getSecret({
  environment: "production",
  projectId: "proj_xxx",
  secretName: "DATABASE_URL",
});

console.log(dbUrl.secretValue);

CI/CD Integration

yaml

# .github/workflows/deploy.yml — Inject secrets in GitHub Actions
name: Deploy
on: push

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: Infisical/secrets-action@v1
        with:
          client-id: ${{ secrets.INFISICAL_CLIENT_ID }}
          client-secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
          project-id: proj_xxx
          env-slug: production

      # All secrets are now environment variables
      - run: npm run deploy

Kubernetes Integration

yaml

# infisical-secret.yaml — Sync to Kubernetes secrets
apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: my-app-secrets
spec:
  hostAPI: https://infisical.mycompany.com
  authentication:
    universalAuth:
      credentialsRef:
        secretName: infisical-credentials
        secretNamespace: default
  managedSecretReference:
    secretName: my-app-env          # Created/synced K8s Secret
    secretNamespace: default
    creationPolicy: Owner
  resyncInterval: 60                # Refresh every 60 seconds

Secret Rotation

bash

# Auto-rotate database credentials
infisical secrets rotation create \
  --provider=postgres \
  --interval=30d \
  --secret-name=DATABASE_URL \
  --env=production

Examples

Example 1: Replace .env files with centralized secrets

User prompt: "Our team shares .env files via Slack. Set up proper secrets management."

The agent will set up Infisical, import existing .env files, configure per-environment secrets, and update the dev workflow to use infisical run.

Example 2: Inject secrets into CI/CD pipeline

User prompt: "Our GitHub Actions workflow hardcodes API keys in repository secrets. Centralize them."

The agent will set up Infisical with a machine identity for CI, configure the GitHub Action to inject secrets, and remove hardcoded values.

Guidelines

infisical run -- replaces .env files — inject secrets as env vars
Per-environment secrets — dev, staging, production with different values
Machine identities for CI — client ID + secret for non-human access
Audit trail — every secret access is logged
Self-hostable — run on your infrastructure for compliance
Kubernetes operator — auto-sync secrets to K8s
Secret rotation — auto-rotate database passwords, API keys
RBAC — control who can access which environments
Version history — see who changed what and when
Point-in-time recovery — rollback to previous secret values

infisical

Usage

Getting Started

Example Prompts

Documentation

Overview

When to Use

Instructions

Setup

Store and Retrieve Secrets

SDK Usage

CI/CD Integration

Kubernetes Integration

Secret Rotation

Examples

Example 1: Replace .env files with centralized secrets

Example 2: Inject secrets into CI/CD pipeline

Guidelines

Information

Use Cases