Skip to main content
Some tasks need the credential itself instead of a session, such as signing in with a desktop client that Infisical can’t connect through, or configuring an appliance by hand. For these tasks, you can reveal the password or key stored for an account.
Once you reveal a credential, Infisical can’t control how it’s used. Infisical doesn’t record what you do with the credential or block any commands, and revoking your access doesn’t invalidate a copy of it. Use a session when you can, and rotate the credential after someone reveals it.

​
Prerequisites

​
Reveal the credential

1
Go to Privileged Access Management > Accounts, then open the options menu on the account’s row and select View Credentials.
2
Enter a Reason and select Reveal. If the account’s template requires MFA, complete MFA in the window that opens.
3
To show a masked value, select the eye icon next to it.
If an account’s auth method doesn’t store a password or key, such as an SSH certificate or AWS IAM, the account has no View Credentials option.

​
Request access to the credential

If the account’s template requires approval, the options menu shows Request Credentials instead of View Credentials. Select Request Credentials to file a request, and reveal the credential after an approver approves it. To learn how requests are reviewed, see Access requests. Infisical approves credential requests and session requests separately. An approved session request doesn’t let you reveal the credential, and an approved credential request doesn’t let you launch a session.

​
Audit log entries

Each time someone reveals a credential, Infisical adds a View PAM Account Credentials event to the audit log. The event names the member, the account, and the reason they gave.