Infisical

Infisical is an open-source secrets manager, hosted or self-hosted, and one of the drivers behind secrets. Your app reads provider keys from an Infisical project on the server and refers to them as secret:NAME. Pick it when you want an open-source manager you can run yourself.

secrets:
  driver: infisical

Before you start

1. Create an Infisical project for the app, with an environment for development, stage and production.
2. Add each secret under the name you will reference, such as RESEND_API_KEY.
3. Create a machine identity for the app with read access to the environment it needs. Prefer an identity-based auth method, such as Kubernetes or OIDC auth, over a static client secret where your platform supports it.

Configure

secrets:
  driver: infisical             # [to be decided] site, project, environment and auth settings are not specified yet
email:
  key: secret:RESEND_API_KEY    # suggested name; read from Infisical at startup

Use it

import { secrets } from "mainsdk";   // server only

export async function partnerToken() {
  return secrets.get("PARTNER_API_TOKEN");
}

Local development and testing

Use the local or env driver in development, or an Infisical development environment. In tests, createTestApp() from @mainsdk/testing uses the in-memory fake, and chaos.on("secrets", { outage: true }) simulates Infisical being down.

What MainSDK adds on top

• Server-only access, with values redacted from logs, errors and telemetry.
• The last good value served from memory during an outage (MAIN-SECRET-0007), never written to disk.
• A key in code, a committed env file or the browser bundle fails mainsdk check.

See Secrets.

Limits and notes

• The driver comes with the config-secrets spec (phase 1).
• If you self-host, where your Infisical instance runs decides where secrets live; match it to your app's region (US, EU or India).
• secrets.raw() returns Infisical's client; mainsdk check lists every use.

Swap to or from it

secrets:
  driver: infisical   # was doppler

FAQ

Does self-hosted Infisical work? The driver talks to Infisical's API; how you point it at your own instance is not specified yet.

Which auth method should I use? One tied to your workload's identity, which MainSDK drivers prefer over static tokens.

Next

• Secrets
• Doppler and HashiCorp Vault

Open questions