Infisical

Infisical centralizes application secrets and configuration across every environment so credentials stop living in shared files and chat threads. What began as a secrets tool now spans certificates, encryption keys and privileged access, with the stated aim of making security tooling usable by people who do not work in security.

Secrets are managed per project and environment from a dashboard, with versioning, point-in-time recovery and rotation built in. Syncs push values out to platforms such as GitHub, Vercel and AWS, while Terraform and Ansible integrations, a Kubernetes operator and an agent deliver them into running workloads without touching application code.

The platform is organized into distinct products over a shared control layer.

• Secrets management: Dynamic short-lived credentials, scheduled rotation and scanning that keeps secrets out of git.
• Certificate management: A private PKI with internal and external CAs, issuance policies, expiry alerting and code signing.
• Key management: Cryptographic keys held centrally and used to encrypt and decrypt project data.
• Privileged access: Just-in-time brokered access to PostgreSQL, SSH, Kubernetes and Active Directory, with session recording.
• Platform controls: Role-based access, temporary privileges, approval workflows and audit logs with optional streaming.

Machine identities authenticate through Kubernetes, GCP, Azure, AWS, OIDC or universal auth, and a gateway reaches private network resources without inbound connections. Client SDKs cover Node, Python, Go, Ruby, Java and .NET alongside a CLI, and the whole platform can be self-hosted on your own infrastructure.