Skip to main content
Accounts are the databases and servers you want to manage through PAM. Each account stores the connection details and credentials needed to connect — hostname, port, username, password, and so on. Whoever connects to an account never sees the actual credentials, whether that is a person or an AI agent. The connection is proxied, credentials are injected automatically, and everything is recorded.

​
Account types

PAM supports the following account types: Each type has specific connection details. See the type-specific pages for details.

​
Adding an account

Accounts live inside folders. To add one:
1

Start adding an account

Go to Privileged Access Management → Accounts and select Add Account.
2

Select a folder and template

Choose which folder to add the account to, then select a template. The template determines the account type and all the rules that apply.
3

Enter connection details

Provide the hostname, port, and other connection information.
4

Enter credentials

Provide the username and password (or SSH key/certificate settings).
5

Save

Select Create.

​
Connecting to an account

Once an account exists, anyone with access can connect: people in the browser or through the CLI, machine identities through the CLI.

​
Web access

Go to Privileged Access Management → Accounts, find the account, and select the rocket icon (or select Launch Session from the menu), then select Connect in Browser. This opens:
  • PostgreSQL / MySQL — a Data Explorer for browsing tables and a SQL Editor for running queries
  • SSH — an interactive terminal
  • AWS IAM — opens the AWS Console with federated credentials
  • Windows / Windows AD — an RDP connection to the server

​
CLI access

Run the CLI command for the account:
For SSH accounts this connects you straight to a shell on the server. Add --proxy if you would rather point your own SSH client at a local port. Every other account type starts a local proxy and outputs the port to connect to. Then connect with your preferred client (psql, pgAdmin, etc.) against localhost using that port. The proxy handles authentication automatically. Flags: To let an AI agent reach an account, use infisical pam agentic access instead.

​
Viewing credentials

Some work needs the password itself, not a session: pasting it into a desktop client Infisical doesn’t broker, or configuring an appliance by hand. Select View Credentials from the account’s menu, give a reason, and the stored fields are shown with secrets masked until revealed. This needs the Operator or Admin role on the folder or account, and an approval when the template requires one — the entry reads Request Credentials until you hold one. Sessions and credentials are approved separately, so an approved session request never reveals the credential. Accounts whose auth method stores no secret (SSH certificate, AWS IAM, PostgreSQL AWS IAM) have nothing to reveal and say so. Every reveal writes a View PAM Account Credentials entry to the audit log with the member, account, and reason.
A revealed credential is outside Infisical: no session recording, no command blocking, and revoking the grant stops further reveals but can’t take back a copied password. Prefer a session where one will do, and rotate the account after a checkout.

​
Direct account memberships

Most access is granted at the folder level — if you have access to the folder, you have access to all accounts in it. But sometimes you need to grant access to just one account. For that, use direct account memberships:
  1. Open the account and go to the Permissions tab
  2. Select Assign Access
  3. Select the user, group, or machine identity, then set the role and an optional expiration
  4. Select Add
Direct memberships are for exceptions: a contractor who needs one specific database, temporary elevated access to a single account, or a job that should reach one account and nothing else.

​
Next steps

For detailed instructions on creating and connecting to specific account types, see the type-specific pages in the sidebar.