Configurations

Read how to configure environment variables for self-hosted Infisical.

Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI and REDIS_URL must be defined. However, you can configure additional settings to activate more features as needed.

General platform

Used to configure platform-specific security and operational settings

ENCRYPTION_KEY · string · default: "none" · required

Must be a random 16 byte hex string. Can be generated with openssl rand -hex 16

AUTH_SECRET · string · default: "none" · required

Must be a random 32 byte base64 string. Can be generated with openssl rand -base64 32

SITE_URL · string · default: "none" · required

Must be an absolute URL including the protocol (e.g. https://app.infisical.com).

PORT · int · default: "8080"

Specifies the internal port on which the application listens.

TELEMETRY_ENABLED · string · default: "true"

Telemetry helps us improve Infisical but if you want to disable it you may set this to false.

CORS

Cross-Origin Resource Sharing (CORS) is a security feature that allows web applications running on one domain to access resources from another domain. The following environment variables can be used to configure the Infisical Rest API to allow or restrict access to resources from different origins.

CORS_ALLOWED_ORIGINS · string

Specify a list of origins that are allowed to access the Infisical API.

An example value would be CORS_ALLOWED_ORIGINS=["https://example.com"].

Defaults to the same value as your SITE_URL environment variable.

CORS_ALLOWED_METHODS · string

Array of HTTP methods allowed for CORS requests.

Defaults to reflecting the headers specified in the request’s Access-Control-Request-Headers header.

Data Layer

The platform utilizes Postgres to persist all of its data and Redis for caching and backgroud tasks

DB_CONNECTION_URI · string · default: "" · required

Postgres database connection string.

DB_ROOT_CERT · string · default: ""

Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. Use the command below to encode your certificate: echo "<certificate>" | base64

REDIS_URL · string · default: "none" · required

Redis connection string.

DB_READ_REPLICAS · string · default: ""

Postgres database read replica connection strings. It accepts a JSON string.

DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]

Show Format

DB_CONNECTION_URI · string · default: "" · required

Postgres read replica connection string.

DB_ROOT_CERT · string · default: ""

Configure the SSL certificate for securing a Postgres replica connection by first encoding it in base64. Use the command below to encode your certificate: echo "<certificate>" | base64

If not provided it will use master SSL certificate.

Email Service

Without email configuration, Infisical’s core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.

Generic Configuration

SMTP_HOST · string · default: "none"

Hostname to connect to for establishing SMTP connections

SMTP_PORT · string · default: "587"

Port to connect to for establishing SMTP connections

SMTP_USERNAME · string · default: "none"

Credential to connect to host (e.g. [e-mail])

SMTP_PASSWORD · string · default: "none"

Credential to connect to host

SMTP_FROM_ADDRESS · string · default: "none"

Email address to be used for sending emails

SMTP_FROM_NAME · string · default: "none"

Name label to be used in From field (e.g. Team)

SMTP_IGNORE_TLS · bool · default: "false"

If this is true and SMTP_PORT is not 465 then TLS is not used even if the server supports STARTTLS extension.

SMTP_REQUIRE_TLS · bool · default: "true"

If this is true and SMTP_PORT is not 465 then Infisical tries to use STARTTLS even if the server does not advertise support for it. If the connection can not be encrypted then message is not sent.

SMTP_TLS_REJECT_UNAUTHORIZED · bool · default: "true"

If this is true, Infisical will validate the server’s SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to false, the client will accept the server’s certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.

Twilio SendGrid

1. Create an account and configure SendGrid to send emails.
2. Create a SendGrid API Key under Settings > API Keys
3. Set a name for your API Key, we recommend using “Infisical,” and select the “Restricted Key” option. You will need to enable the “Mail Send” permission as shown below:

4. With the API Key, you can now set your SMTP environment variables:

SMTP_HOST=smtp.sendgrid.net
SMTP_USERNAME=apikey
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
SMTP_PORT=587
SMTP_FROM_ADDRESS=[e-mail] # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

Remember that you will need to restart Infisical for this to work properly.

Mailgun

1. Create an account and configure Mailgun to send emails.
2. Obtain your Mailgun credentials in Sending > Overview > SMTP

3. With your Mailgun credentials, you can now set up your SMTP environment variables:

SMTP_HOST=smtp.mailgun.org # obtained from credentials page
SMTP_USERNAME=[e-mail] # obtained from credentials page
SMTP_PASSWORD=password # obtained from credentials page
SMTP_PORT=587
SMTP_FROM_ADDRESS=[e-mail] # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

AWS SES

1. Create a verifed identity

   This will be used to verify the email you are sending from.

   If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies.

2. Create an account and configure AWS SES

   Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentials

3. Set up your SMTP environment variables

   With your AWS SES SMTP credentials, you can now set up your SMTP environment variables for your Infisical instance.

   SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settings
   SMTP_USERNAME=xxx # your SMTP username
   SMTP_PASSWORD=xxx # your SMTP password
   SMTP_PORT=465
   SMTP_FROM_ADDRESS=[e-mail] # your email address being used to send out emails
   SMTP_FROM_NAME=Infisical
   

Remember that you will need to restart Infisical for this to work properly.

SocketLabs

1. Create an account and configure SocketLabs to send emails.
2. From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.

3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:

SMTP_HOST=smtp.socketlabs.com
SMTP_USERNAME=username # obtained from your credentials
SMTP_PASSWORD=password # obtained from your credentials
SMTP_PORT=587
SMTP_FROM_ADDRESS=[e-mail] # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

The SMTP_FROM_ADDRESS environment variable should be an email for an authenticated domain under Configuration > Domain Management in SocketLabs. For example, if you’re using SocketLabs in sandbox mode, then you may use an email like [e-mail].

Remember that you will need to restart Infisical for this to work properly.

Resend

1. Create an account on Resend.
2. Add a Domain.

3. Create an API Key.

4. Go to the SMTP page and copy the values.

5. With the API Key, you can now set your SMTP environment variables variables:

SMTP_HOST=smtp.resend.com
SMTP_USERNAME=resend
SMTP_PASSWORD=YOUR_API_KEY
SMTP_PORT=587
SMTP_FROM_ADDRESS=[e-mail] # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

Remember that you will need to restart Infisical for this to work properly.

Gmail

Create an account and enable “less secure app access” in Gmail Account Settings > Security. This will allow applications like Infisical to authenticate with Gmail via your username and password.

With your Gmail username and password, you can set your SMTP environment variables:

SMTP_HOST=smtp.gmail.com
SMTP_USERNAME=[e-mail] # your email
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=[e-mail]
SMTP_FROM_NAME=Infisical

As per the notice by Google, you should note that using Gmail credentials for SMTP configuration will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.

Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.

Office365

1. Create an account and configure Office365 to send emails.

2. With your login credentials, you can now set up your SMTP environment variables:

SMTP_HOST=smtp.office365.com
SMTP_USERNAME=[e-mail] # your username
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=[e-mail]
SMTP_FROM_NAME=Infisical

Zoho Mail

1. Create an account and configure Zoho Mail to send emails.

2. With your email credentials, you can now set up your SMTP environment variables:

SMTP_HOST=smtp.zoho.com
SMTP_USERNAME=username # your email
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=[e-mail] # your personal Zoho email or domain-based email linked to Zoho Mail
SMTP_FROM_NAME=Infisical

You can use either your personal Zoho email address like [e-mail] or a domain-based email address like [e-mail]. If using a domain-based email address, then please make sure that you’ve configured and verified it with Zoho Mail.

Remember that you will need to restart Infisical for this to work properly.

SMTP2Go

1. Create an account and configure SMTP2Go to send emails.
2. Turn on SMTP authentication

SMTP_HOST=mail.smtp2go.com
SMTP_PORT=You can use one of the following ports: 2525, 80, 25, 8025, or 587
SMTP_USERNAME=username #Your SMTP2GO account's SMTP username
SMTP_PASSWORD=password #Your SMTP2GO account's SMTP password
SMTP_FROM_ADDRESS=[e-mail] # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

Optional (for TLS/SSL):

TLS: Available on the same ports (2525, 80, 25, 8025, or 587) SSL: Available on ports 465, 8465, and 443

Authentication

By default, users can only login via email/password based login method. To login into Infisical with OAuth providers such as Google, configure the associated variables.

DEFAULT_SAML_ORG_SLUG · string

When set, all visits to the Infisical login page will automatically redirect users of your Infisical instance to the SAML identity provider associated with the specified organization slug.

Google

Follow detailed guide to configure Google SSO

CLIENT_ID_GOOGLE_LOGIN · string · default: "none"

OAuth2 client ID for Google login

CLIENT_SECRET_GOOGLE_LOGIN · string · default: "none"

OAuth2 client secret for Google login

Github

Follow detailed guide to configure GitHub SSO

CLIENT_ID_GITHUB_LOGIN · string · default: "none"

OAuth2 client ID for GitHub login

CLIENT_SECRET_GITHUB_LOGIN · string · default: "none"

OAuth2 client secret for GitHub login

Gitlab

Follow detailed guide to configure GitLab SSO

CLIENT_ID_GITLAB_LOGIN · string · default: "none"

OAuth2 client ID for GitLab login

CLIENT_SECRET_GITLAB_LOGIN · string · default: "none"

OAuth2 client secret for GitLab login

URL_GITLAB_LOGIN · string · default: "https://gitlab.com"

URL of your self-hosted instance of GitLab where the OAuth application is registered

Okta SAML

Requires enterprise license. Please contact [e-mail] to get more information.

Azure SAML

Requires enterprise license. Please contact [e-mail] to get more information.

JumpCloud SAML

Requires enterprise license. Please contact [e-mail] to get more information.

App Connections

You can configure third-party app connections for re-use across Infisical Projects.

AWS Assume Role Connection

INF_APP_CONNECTION_AWS_ACCESS_KEY_ID · string · default: "none"

The AWS IAM User access key ID for assuming roles

INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY · string · default: "none"

The AWS IAM User secret key for assuming roles

GitHub App Connection

INF_APP_CONNECTION_GITHUB_APP_ID · string · default: "none"

The ID of the GitHub App

INF_APP_CONNECTION_GITHUB_APP_SLUG · string · default: "none"

The slug of the GitHub App

INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID · string · default: "none"

The client ID for the GitHub App

INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET · string · default: "none"

The client secret for the GitHub App

INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY · string · default: "none"

The private key for the GitHub App

GitHub OAuth Connection

INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_ID · string · default: "none"

The OAuth2 client ID for GitHub OAuth Connection

INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_SECRET · string · default: "none"

The OAuth2 client secret for GitHub OAuth Connection

Native Secret Integrations

To help you sync secrets from Infisical to services such as Github and Gitlab, Infisical provides native integrations out of the box.

Heroku

CLIENT_ID_HEROKU · string · default: "none"

OAuth2 client ID for Heroku integration

CLIENT_SECRET_HEROKU · string · default: "none"

OAuth2 client secret for Heroku integration

Vercel

CLIENT_ID_VERCEL · string · default: "none"

OAuth2 client ID for Vercel integration

CLIENT_SECRET_VERCEL · string · default: "none"

OAuth2 client secret for Vercel integration

CLIENT_SLUG_VERCEL · string · default: "none"

OAuth2 slug for Vercel integration

Netlify

CLIENT_ID_NETLIFY · string · default: "none"

OAuth2 client ID for Netlify integration

CLIENT_SECRET_NETLIFY · string · default: "none"

OAuth2 client secret for Netlify integration

Github

CLIENT_ID_GITHUB · string · default: "none"

OAuth2 client ID for GitHub integration

CLIENT_SECRET_GITHUB · string · default: "none"

OAuth2 client secret for GitHub integration

Bitbucket

CLIENT_ID_BITBUCKET · string · default: "none"

OAuth2 client ID for BitBucket integration

CLIENT_SECRET_BITBUCKET · string · default: "none"

OAuth2 client secret for BitBucket integration

GCP Secrets Manager

CLIENT_ID_GCP_SECRET_MANAGER · string · default: "none"

OAuth2 client id for GCP secrets manager integration

CLIENT_SECRET_GCP_SECRET_MANAGER · string · default: "none"

OAuth2 client secret for GCP secrets manager integration

AWS Integration

CLIENT_ID_AWS_INTEGRATION · string · default: "none"

The AWS IAM User access key for assuming roles.

CLIENT_SECRET_AWS_INTEGRATION · string · default: "none"

The AWS IAM User secret key for assuming roles.

Azure

CLIENT_ID_AZURE · string · default: "none"

OAuth2 client id for Azure integration

CLIENT_SECRET_AZURE · string · default: "none"

OAuth2 client secret for Azure integration

Gitlab

CLIENT_ID_GITLAB · string · default: "none"

OAuth2 client id for Gitlab integration

CLIENT_SECRET_GITLAB · string · default: "none"

OAuth2 client secret for Gitlab integration

Observability

You can configure Infisical to collect and expose telemetry data for analytics and monitoring.

OTEL_TELEMETRY_COLLECTION_ENABLED · string · default: "false"

Whether or not to collect and expose telemetry data.

OTEL_EXPORT_TYPE · enum

Supported types are prometheus and otlp.

If export type is set to prometheus, metric data will be exposed in port 9464 in the /metrics path.

If export type is set to otlp, you will have to configure a value for OTEL_EXPORT_OTLP_ENDPOINT.

OTEL_EXPORT_OTLP_ENDPOINT · string

Where telemetry data would be pushed to for collection. This is only applicable when OTEL_EXPORT_TYPE is set to otlp.

OTEL_COLLECTOR_BASIC_AUTH_USERNAME · string

The username for authenticating with the telemetry collector.

OTEL_COLLECTOR_BASIC_AUTH_PASSWORD · string

The password for authenticating with the telemetry collector.