Skip to main content
A stored credential can stop working without anyone noticing. Someone changes a password directly on the target, an administrator disables an account, or a service principal’s secret expires. Nothing tells Infisical, so the credential sits in the vault looking fine until a session fails or a rotation breaks. Credential health checks each account on a schedule by signing in to its target with the stored credential, then records what happened. The check is read-only: it proves the credential still authenticates and changes nothing on the target.

​
Concepts

Checking is configured on the account template, which sets whether accounts are checked and how often. Every account created from the template inherits those settings. There is no per-account override, so accounts that need a different frequency belong on a different template. Templates have checking on by default, every 24 hours.

​
Statuses

An account’s health is always in one of four states: The account list shows a badge for Out of Sync and Unreachable only. A healthy account needs no attention, so it carries no badge.

​
How it works

Each check signs in the same way a session would, using the account’s own authentication method, and then disconnects. For most resources this means a login through the gateway that serves the account. Cloud accounts have no host to reach, so their check asks the provider for short-lived credentials instead. Checks are spread across the interval rather than fired together, so a template with many accounts doesn’t sign in to one domain controller all at once. Every check is recorded in the audit log.
Microsoft SQL Server accounts using Windows authentication need a gateway running a version that supports the Windows authentication handshake. An older gateway reports these accounts as Out of Sync even when the credential is valid. Update the gateway to get an accurate result.

​
Configuring a template

Template settings are managed by a Product Admin. Go to Privileged Access Management → Account Templates, open a template, and find Credential Health. Turn on Check credentials and set Check every to 1 hour, 12 hours, 24 hours, 7 days, or 30 days. Turning it off stops scheduled checks for every account on the template. Each account keeps the result of its last check, labelled as having been taken before checking was turned off.

​
Viewing an account’s health

Open an account and go to the Configuration tab. The Credential health section shows the current status, when the account was last checked, and when it was last healthy. When a check fails, the reason the target gave appears below. Select Check now to run a check immediately. This requires permission to view the account’s credentials, since the check signs in with them.
AWS IAM accounts store no credentials of their own, since Infisical assumes their role instead. They have no Credential health section and no Check now button. They’re still checked on schedule, and their status appears as a badge in the account list.

​
When checking stops

A rejected credential takes the account off the schedule. Retrying a password the target has already refused is how a monitoring feature locks out a privileged account, so Infisical stops after the first rejection and waits for a person. Checking resumes when you:
  • Enter the credential again on the account.
  • Select Check now and the check succeeds.
  • Rotate the account, since rotation verifies the new password before it commits.
An Unreachable account keeps being checked, because an unreachable target says nothing about the credential and retrying costs nothing. Changing an account’s host or gateway also pauses checking if you can’t view that account’s credentials, so the next check doesn’t carry the stored credential to a target you just chose. The account’s reason line says so, and entering the credential or running a check resumes it.