---
title: "Infisical"
description: "Use Infisical for MainSDK secrets - machine identity setup, main.yaml, secret references, local testing and swapping."
section: "integrations"
canonical: "https://mainsdk.dev/docs/integrations/infisical"
updated: "2026-10-28"
---

# Infisical

> Use Infisical for MainSDK secrets - machine identity setup, main.yaml, secret references, local testing and swapping.

Canonical: https://mainsdk.dev/docs/integrations/infisical · Updated: 2026-10-28

Infisical is an open-source secrets manager, hosted or self-hosted, and one of the drivers behind [`secrets`](https://mainsdk.dev/docs/interfaces/secrets). Your app reads provider keys from an Infisical project on the server and refers to them as `secret:NAME`. Pick it when you want an open-source manager you can run yourself.

## Interfaces it serves

### Secrets (`secrets`)

- Status: Building for 0.2 · ships as a stable API
- Driver: `infisical` (Infisical)
- Docs: https://mainsdk.dev/docs/interfaces/secrets.md

```yaml
secrets:
  driver: infisical
```

Swap to another provider: `vault`, `aws-secrets-manager`, `gcp-secret-manager`, `azure-key-vault`, `doppler`, `env`, `local`.

## Before you start

1. Create an Infisical project for the app, with an environment for development, stage and production.
2. Add each secret under the name you will reference, such as `RESEND_API_KEY`.
3. Create a machine identity for the app with read access to the environment it needs. Prefer an identity-based auth method, such as Kubernetes or OIDC auth, over a static client secret where your platform supports it.

## Configure

```yaml title="main.yaml"
secrets:
  driver: infisical             # [TBD] site, project, environment and auth settings are not specified yet
email:
  key: secret:RESEND_API_KEY    # suggested name; read from Infisical at startup
```

## Use it

```ts title="app/lib/partner.ts"
import { secrets } from "mainsdk";   // server only

export async function partnerToken() {
  return secrets.get("PARTNER_API_TOKEN");
}
```

## Local development and testing

Use the `local` or `env` driver in development, or an Infisical development environment. In tests, `createTestApp()` from `@mainsdk/testing` uses the in-memory fake, and `chaos.on("secrets", { outage: true })` simulates Infisical being down.

## What MainSDK adds on top

- Server-only access, with values redacted from logs, errors and telemetry.
- The last good value served from memory during an outage (`MAIN-SECRET-0007`), never written to disk.
- A key in code, a committed env file or the browser bundle fails `mainsdk check`.

See [Secrets](https://mainsdk.dev/docs/interfaces/secrets).

## Limits and notes

- The driver comes with the config-secrets spec (phase 1).
- If you self-host, where your Infisical instance runs decides where secrets live; match it to your app's region (US, EU or India).
- `secrets.raw()` returns Infisical's client; `mainsdk check` lists every use.

## Swap to or from it

```yaml title="main.yaml"
secrets:
  driver: infisical   # was doppler
```

> **Warning:** Secrets are read in place and MainSDK copies nothing between managers. Create the same names in the new manager before you swap.

## FAQ

**Does self-hosted Infisical work?** The driver talks to Infisical's API; how you point it at your own instance is not specified yet [TBD].

**Which auth method should I use?** One tied to your workload's identity, which MainSDK drivers prefer over static tokens.

## Next

- [Secrets](https://mainsdk.dev/docs/interfaces/secrets)
- [Doppler](https://mainsdk.dev/docs/integrations/doppler) and [HashiCorp Vault](https://mainsdk.dev/docs/integrations/hashicorp-vault)