Introduction

No. Infisical uses end-to-end encryption which ensures that secrets are always encrypted in transit and decrypted on the client side. In fact, not even the server can decrypt your secrets (unless that permission is explicitly granted from within the platform).

Check out the security guide.

The client SDK caches every secret and implements a 5-minute waiting period before re-requesting it. The waiting period can be controlled by setting the cacheTTL parameter at the time of initializing the client.

The SDK caches every secret and falls back to the cached value if a request fails. If no cached value ever-existed, the SDK falls back to whatever value is on process.env.

Yes. If no token parameter is passed in at the time of initializing the client or nothing is found when requesting for a secret, then the SDK falls back to whatever value is on process.env.

The token enables the SDK to authenticate with Infisical to fetch back your secrets. Although the SDK requires you to pass in a token, it enables greater efficiency and security than if you managed dozens of secrets yourself without it. Here’re some benefits:

• You always pull in the right secrets because they’re fetched on demand from a centralize source that is Infisical.
• You can use the Infisical which comes with tons of benefits like secret versioning, access controls, audit logs, etc.
• You now risk leaking one token that can be revoked instead of dozens of raw secrets.

And much more.