Simple secrets management for humans and machines.

Centralize secrets, automated rotations, and access controls in one open-source platform.

Talk to an expertStart free trial
Name
Development
Staging
Prod – Core
Staging/k8-operator-secrets
aws_credentials
gitlab_cicd_variables
stripe_api_key
datadog_api_key
k8-operator-secrets
Trusted by the best teams in the world

The problem

Secrets are everywhere, rotation nowhere.

Scattered secrets across CI pipelines, .env files, Git repos, and password managers make rotations a nightmare, observability impossible, and access policies inconsistent.

The first secrets manager engineers love.

Infisical centralizes your secrets and delivers them to developers, workloads, and AI agents on self-hosted or cloud infrastructure. Secrets arrive everywhere they need to, and nowhere they don't.

Secret
Dev
Staging
Prod
STRIPE_API_KEY
DATABASE_URL
REDIS_PASSWORD
JWT_SIGNING_KEY
Store

One source of truth for every secret

Centralize secrets management in an encrypted key store with environment separation, secret referencing, plugins, and secret syncs.

Versioned historyPer-env scopingAES-256-GCM
Access grantActive
Identityci-deployer
RoleDeploy · read-only
Scope/prod/secrets/*
Expiresin 04:00Temporary
staging-bot → /prod/dbDenied
Control

Access controls that enforce least privilege

Scope granular access by role, project, and environment for humans and machine identities with RBAC and temporary access grants. Log every event to be audit-ready anytime.

RBACTemporary accessFull audit log
Rotation policyevery 30d
v41 · retiring
v42 · live
overlap
zero downtime
Rotate

Automated secret rotations on your schedule

Set a rotation policy to rotate secrets automatically, not by memory. Avoid downtime with dual-phase rotations that never retire a secret until the new one propagates.

Automatic rotationDual-phase
Integrate

Works wherever you do

Infisical fits into your stack with a CLI, SDKs, and a dashboard for humans. Native integrations, syncs, and Kubernetes/Terraform resources make secrets effortless for machines.

100+ integrationsCI/CDKubernetes operator
Deploy to
Infisical CloudEU regionSelected
Infisical CloudUS region
Self-hostedDocker · K8s · any cloud
MIT · Open source
Host

Host anywhere

Infisical is open-source, so you can use our EU or US cloud regions, or self-host on any cloud, on-premises, or hybrid infrastructure.

EU + US cloudSelf-hostOpen source

Agents shouldn't see your secrets.Give agents access without handing them credentials.

See Agent Vault
Scoped access
You decide which tools and APIs each agent can reach. Everything else is blocked at the proxy.
No leaked secrets
The agent only ever sees placeholders. Real secrets are attached at the proxy and never reach the agent.
Full audit trail
Every request an agent makes is routed through Infisical and logged, so you can see exactly what your agents are doing.

How it works

From scattered secrets to one source of truth.

Import what you already have, reach it from anywhere in your stack, and let rotations run on their own.

Why engineering orgs run Infisical in production.

We're not a well-kept secret.

“Infisical removed a lot of the day-to-day overhead around secrets management.”

Ben ParadisPrincipal Security Engineer
Read the story

“Infisical is a rare developer tool that can both increase productivity and improve security.”

Adrien CarreiraHead of Infrastructure
Read the story

Frequently asked questions

Everything you need to know. Can't find an answer? Talk to our team.

Most teams migrate to Infisical quickly, but this depends on the current setup. Importing .env files is one CLI command and teams are often running in less than an hour. Migrating from legacy vendors might take a bit longer, but is incremental. Secrets migrate nearly instantly with secret syncs while replicating access policies, rotations, and automations is a one-time effort. Most organizations move over new projects immediately and transition existing ones later.

A single Docker Compose command gets a self-hosted instance running while Infisical Cloud only requires installing the CLI. Projects, environments, and access policies are configured through the dashboard, CLI, API, Terraform, or however your team already works.

Infisical pricing is simple: the core platform is open source under the MIT license and free to self-host, with a free cloud tier for small teams. Paid tier pricing is public and scales with the number of human and machine identities. Enterprise quotes are custom.

Secrets are encrypted with AES-256-GCM at rest and in transit. Infisical Cloud is SOC 2 Type II certified, with EU and US clusters for organizations with data residency requirements.

You create a project, import your secrets from an existing .env, via secret sync, or manually, then connect an integration or run the CLI. No credit card is required to start, and the free tier has no time limit.

Yes. The core platform is open source under the MIT license, with 28,000+ GitHub stars.

Yes, through a native Kubernetes operator. It installs as CRDs in your cluster and continuously syncs secrets into native Kubernetes secret objects, so pods consume them normally with no application code changes.

Yes. The Infisical Terraform provider lets you pull secrets into your configuration and provisions Infisical itself as resources. It also creates secrets as ephemeral resources that are never written into state.

Infisical supports scheduled automatic rotation, where old and new credentials briefly overlap so nothing breaks mid-rotation, as well as fully dynamic secrets that are generated on demand and expire after use.

Yes. Machine identities let services, CI jobs, and AI agents authenticate and pull only the secrets they're scoped to, with the same audit logging and access controls as human users. For AI agents, Infisical offers Agent Vault, a credential broker that keeps credentials out of the agent entirely, so a prompt-injected agent has nothing to leak.

Yes. Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, and other secrets managers are supported migration sources. Import existing secrets via the CLI or secret syncs and automatically migrate your setup.

Yes. SAML, OIDC, and SCIM provisioning work with Okta, Azure AD/Entra, Google, and other major identity providers. These are available on Infisical Cloud's paid tiers or with a self-hosted license.

Enterprise customers get dedicated support with defined SLAs. Self-hosting paying customers on other plans get priority support.

Yes. Projects, environments, and identities scale independently, and organizations run Infisical with thousands of combined human and machine identities across many projects today.

Your secrets, under control in ten minutes.

  1. Run

    Run one CLI command or docker compose up to get started.

  2. Import

    Import your existing .env files with a single command.

  3. Inject

    Inject secrets into your first service in under 10 minutes.