Skip to main content
A stored credential can stop working without Infisical knowing, such as when someone changes a password directly on the target, or when a service principal’s secret expires. Sessions and rotations that use the credential then fail. Credential health checks each account on a schedule by signing into each account’s target with the stored credential and recording the result. The check is read-only: it proves the credential still authenticates and changes nothing on the target.

​
How it works

A check signs in the same way a session does, using the account’s authentication method, and then disconnects. For most account types, the check connects through the account’s Gateway: Infisical spreads checks across the interval instead of running them all at once, and records every check in the audit logs. Some account types need a recent Gateway for an accurate result:
  • Oracle: The Gateway must run v0.43.133 or later, and the password must be 30 characters or fewer, or the account shows as Unreachable
  • Microsoft SQL Server with Windows authentication: An older Gateway reports the account as Out of Sync even when the credential works, so update the Gateway

​
Configure checks on a template

You configure credential health on the account template, and every account on the template uses the template’s settings. To check some accounts on a different schedule, move them to a different template. You need the Product Admin role to change a template. New templates check credentials every 24 hours.
1
Go to Privileged Access Management > Account Templates and select the template.
2
Under Credential Health, turn on Check credentials and set Check every to 1 hour, 12 hours, 24 hours, 7 days, or 30 days.
3
Select Save Changes.
If you turn off Check credentials, scheduled checks stop for every account on the template, and each account keeps the result of its last check.

​
Check an account’s health

Go to Privileged Access Management > Accounts, open the options menu on the account’s row, select Configure, and open the Configuration tab. The Credential health section shows the account’s status, when it was last checked, and when it was last healthy. If a check failed, the section also shows the reason that the target gave. Each account has one of four statuses: The Accounts page also shows a badge on accounts that are Out of Sync or Unreachable. To run a check right away, select Check now. You need permission to view the account’s credentials, because the check signs in with them.
AWS IAM accounts don’t store a credential, so they have no Credential health section and no Check now button. Infisical still checks them on the template’s schedule, and the Accounts page shows their badge.

​
When checks stop

If the target rejects a credential, Infisical stops checking the account, so it doesn’t lock out the account by retrying a rejected password. Checks start again when you do one of the following:
  • Enter the credential again on the account
  • Select Check now and the check succeeds
  • Rotate the account, which checks the new password before saving it
If an account is Unreachable, Infisical keeps checking it on schedule. If you change an account’s host or Gateway and you can’t view the account’s credentials, Infisical pauses checks on the account. This stops the next check from sending the stored credential to the new target. To start checks again, enter the credential again or select Check now.