Quickstarts

Guides for the most common tasks in Infisical, grouped by product area.

Secrets Management

Store secrets in Infisical and deliver them to the applications and infrastructure that use them.

Quickstart	Description
Add your secrets to Infisical	Store your secrets in Infisical and inject them into a running application.
Run an app locally with secrets from Infisical	Use the Infisical CLI to inject secrets into a locally running application.
Inject secrets into a Docker container	Deliver secrets from Infisical to a Docker container at startup.
Inject secrets into a GitHub Actions workflow	Fetch secrets from Infisical inside a GitHub Actions workflow at runtime.
Sync secrets into Kubernetes	Use the Infisical Kubernetes Operator to pull secrets into a cluster.
Rotate a PostgreSQL credential	Automatically replace a PostgreSQL credential on a schedule.
Generate a short-lived PostgreSQL credential	Generate a PostgreSQL credential on demand and revoke it after a short period.

Issue and manage X.509 certificates through a private or public certificate authority.

Quickstart	Description
Issue your first certificate	Set up a certificate authority and issue an X.509 certificate.
Enroll certificates with ACME	Issue certificates to servers and workloads through the ACME protocol.
Enroll a device with Microsoft Intune SCEP	Push certificates to Intune-managed devices through SCEP.

Give users time-bound, audited access to databases and servers without sharing the underlying credential.

Quickstart	Description
Access a database or server through Infisical	Open a session to a database or server without exposing the credential.
Open an SSH session through Infisical	Reach a server over SSH without handing out the credential.
Access a PostgreSQL database through Infisical	Open a session to a PostgreSQL database without exposing the credential.

Let AI agents call third-party APIs through a proxy that attaches stored credentials on the way out, so the agent never sees them.

Quickstart	Description
Launch an agent through Agent Vault	Run an AI agent that reaches external APIs without holding real credentials.
Build an access bundle	Define the set of services an agent session can reach.
Add a service to an access bundle	Store credentials for an external API the proxy will call on the agent’s behalf.

Store cryptographic keys in Infisical and use them to encrypt, decrypt, and sign.

Quickstart	Description
Back Infisical KMS with an HSM	Use a hardware security module to protect the root key.
Encrypt Kubernetes secrets with Infisical KMS	Use Infisical KMS as the encryption provider for Kubernetes secrets.
Sign container images with Cosign	Use a key from Infisical KMS to sign and verify container images with Cosign.
Serve keys through KMIP	Expose keys from Infisical KMS to KMIP clients.

Detect credentials that have been committed to a source code repository.

Quickstart	Description
Scan a GitHub repository for leaked secrets	Connect a GitHub repository to Infisical and detect exposed credentials.
Scan a GitLab repository for leaked secrets	Connect a GitLab repository to Infisical and detect exposed credentials.
Scan a Bitbucket repository for leaked secrets	Connect a Bitbucket repository to Infisical and detect exposed credentials.

Authenticate applications and users to Infisical.

Quickstart	Description
Authenticate a machine identity with universal auth	Configure universal auth so an application can authenticate with a client ID and secret.
Authenticate a workload from Kubernetes	Use a Kubernetes service account token to authenticate a workload with Infisical.
Authenticate a workload with OIDC	Use an OIDC identity token from a supported provider to authenticate a workload.
Set up single sign-on	Configure SSO through a supported identity provider.

Reach systems that aren’t on the public internet through a Gateway.

Quickstart	Description
Reach private systems with a Gateway	Set up a Gateway to reach systems that aren’t on the public internet.
Deploy a Gateway	Install and run a Gateway in your own infrastructure.

Run Infisical on your own infrastructure.

Quickstart	Description
Self-host Infisical with Docker Compose	Run Infisical on your own infrastructure using Docker Compose.
Self-host Infisical with the standalone Docker image	Run the frontend and backend from a single Docker image.
Self-host Infisical on Kubernetes with Helm	Deploy Infisical to a Kubernetes cluster with the Helm chart.
Self-host Infisical on AWS with ECS Fargate	Deploy Infisical on AWS using ECS Fargate, RDS, and ElastiCache.
Self-host Infisical on GCP with GKE	Deploy Infisical on GCP using GKE, Cloud SQL, and Memorystore.
Install Infisical from the Linux package	Install Infisical directly on a Linux host with the native package.

Programmatically manage resources over HTTPS with the Infisical REST API.

Quickstart	Description
Make your first authenticated API request	Create a machine identity, authenticate with Universal Auth, and call the Infisical API.