Skip to main content
Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI and REDIS_URL must be defined. However, you can configure additional settings to activate more features as needed.

​
General platform

Used to configure platform-specific security and operational settings
​
ENCRYPTION_KEY
string
default:"none"
required
Must be a random 16 byte hex string. Can be generated with openssl rand -hex 16
​
AUTH_SECRET
string
default:"none"
required
Must be a random 32 byte base64 string. Can be generated with openssl rand -base64 32
​
SITE_URL
string
default:"none"
required
Must be an absolute URL including the protocol (e.g. https://app.infisical.com).
​
PORT
int
default:"8080"
Specifies the internal port on which the application listens.
​
HOST
string
default:"localhost"
Specifies the network interface Infisical will bind to when accepting incoming connections.By default, Infisical binds to localhost, which restricts access to connections from the same machine.To make the application accessible externally (e.g., for self-hosted deployments), set this to 0.0.0.0, which tells the server to listen on all network interfaces.Example values:
  • localhost (default, same as 127.0.0.1)
  • 0.0.0.0 (all interfaces, accessible externally)
  • 192.168.1.100 (specific interface IP)
​
TELEMETRY_ENABLED
string
default:"true"
Telemetry helps us improve Infisical but if you want to disable it you may set this to false.
​
ALLOW_INTERNAL_IP_CONNECTIONS
bool
default:"false"
Determines whether App Connections and Dynamic Secrets are permitted to connect with internal/private IP addresses.
​
KUBERNETES_AUTO_FETCH_SERVICE_ACCOUNT_TOKEN
bool
default:"false"
Determines whether your Infisical instance can automatically read the service account token of the pod it’s running on. Used for features such as the IRSA auth method.
​
DISABLE_AUDIT_LOG_STORAGE
string
default:"false"
Disable storing audit logs in the database. This is useful if you’re using audit log streams and don’t want to store them in the database.

​
CORS

Cross-Origin Resource Sharing (CORS) is a security feature that allows web applications running on one domain to access resources from another domain. The following environment variables can be used to configure the Infisical Rest API to allow or restrict access to resources from different origins.
​
CORS_ALLOWED_ORIGINS
string
Specify a list of origins that are allowed to access the Infisical API.An example value would be CORS_ALLOWED_ORIGINS=["https://example.com"].Defaults to the same value as your SITE_URL environment variable.
​
CORS_ALLOWED_METHODS
string
Array of HTTP methods allowed for CORS requests.Defaults to reflecting the headers specified in the request’s Access-Control-Request-Headers header.

​
Data Layer

The platform utilizes Postgres to persist all of its data and Redis for caching and backgroud tasks

​
PostgreSQL

Please note that the database user you create must be granted all privileges on the Infisical database. This includes the ability to create new schemas, create, update, delete, modify tables and indexes, etc.
​
DB_CONNECTION_URI
string
default:""
required
Postgres database connection string.
​
DB_ROOT_CERT
string
default:""
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. Use the following command to encode your certificate: echo "<certificate>" | base64
​
DB_READ_REPLICAS
string
default:""
Postgres database read replica connection strings. It accepts a JSON string.
DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]

​
Redis

Redis is used for caching and background tasks. You can use either a standalone Redis instance or a Redis Sentinel setup.
  • Redis Standalone
  • Redis Sentinel
  • Redis Cluster
  • Redis Read Replica
​
REDIS_URL
string
default:"none"
required
Redis connection string.

​
Email Service

Without email configuration, Infisical’s core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.
​
SMTP_HOST
string
default:"none"
Hostname to connect to for establishing SMTP connections
​
SMTP_PORT
string
default:"587"
Port to connect to for establishing SMTP connections
​
SMTP_USERNAME
string
default:"none"
Credential to connect to host (e.g. team@infisical.com)
​
SMTP_PASSWORD
string
default:"none"
Credential to connect to host
​
SMTP_FROM_ADDRESS
string
default:"none"
Email address to be used for sending emails
​
SMTP_FROM_NAME
string
default:"none"
Name label to be used in From field (e.g. Team)
​
SMTP_IGNORE_TLS
bool
default:"false"
If this is true and SMTP_PORT is not 465 then TLS is not used even if the server supports STARTTLS extension.
​
SMTP_REQUIRE_TLS
bool
default:"true"
If this is true and SMTP_PORT is not 465 then Infisical tries to use STARTTLS even if the server does not advertise support for it. If the connection can not be encrypted then message is not sent.
​
SMTP_TLS_REJECT_UNAUTHORIZED
bool
default:"true"
If this is true, Infisical will validate the server’s SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to false, the client will accept the server’s certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.
​
SMTP_CUSTOM_CA_CERT
string
default:"none"
If your SMTP server uses a certificate signed by a custom Certificate Authority, you should set this variable so that Infisical can trust the custom CA.This variable must be a base64 encoded PEM certificate. Use the following command to encode your certificate: echo "<certificate>" | base64Infisical highly encourages the following variables be used alongside this one for maximum security:
  • SMTP_REQUIRE_TLS=true
  • SMTP_TLS_REJECT_UNAUTHORIZED=true
  1. Create an account and configure SendGrid to send emails.
  2. Create a SendGrid API Key under Settings > API Keys
  3. Set a name for your API Key, we recommend using “Infisical,” and select the “Restricted Key” option. You will need to enable the “Mail Send” permission as shown below:
creating sendgrid api keysetting sendgrid api key restriction
  1. With the API Key, you can now set your SMTP environment variables:
SMTP_HOST=smtp.sendgrid.net
SMTP_USERNAME=apikey
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
  1. Create an account and configure Mailgun to send emails.
  2. Obtain your Mailgun credentials in Sending > Overview > SMTP
obtain mailhog api key estriction
  1. With your Mailgun credentials, you can now set up your SMTP environment variables:
SMTP_HOST=smtp.mailgun.org # obtained from credentials page
SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
SMTP_PASSWORD=password # obtained from credentials page
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical
1

Create a verifed identity

This will be used to verify the email you are sending from.Create SES identity
If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies.
2

Create an account and configure AWS SES

Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentialsopening AWS SES consolecreating AWS IAM SES user
3

Set up your SMTP environment variables

With your AWS SES SMTP credentials, you can now set up your SMTP environment variables for your Infisical instance.
SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settings
SMTP_USERNAME=xxx # your SMTP username
SMTP_PASSWORD=xxx # your SMTP password
SMTP_PORT=465
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
  1. Create an account and configure SocketLabs to send emails.
  2. From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
opening SocketLabs dashboardobtaining SocketLabs credentials
  1. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
SMTP_HOST=smtp.socketlabs.com
SMTP_USERNAME=username # obtained from your credentials
SMTP_PASSWORD=password # obtained from your credentials
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical
The SMTP_FROM_ADDRESS environment variable should be an email for an authenticated domain under Configuration > Domain Management in SocketLabs. For example, if you’re using SocketLabs in sandbox mode, then you may use an email like team@sandbox.socketlabs.dev.
SocketLabs domain management
Remember that you will need to restart Infisical for this to work properly.
  1. Create an account on Resend.
  2. Add a Domain.
adding resend domain
  1. Create an API Key.
creating resend api key
  1. Go to the SMTP page and copy the values.
go to resend smtp settings
  1. With the API Key, you can now set your SMTP environment variables variables:
SMTP_HOST=smtp.resend.com
SMTP_USERNAME=resend
SMTP_PASSWORD=YOUR_API_KEY
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
Create an account and enable “less secure app access” in Gmail Account Settings > Security. This will allow applications like Infisical to authenticate with Gmail via your username and password.Gmail secure app accessWith your Gmail username and password, you can set your SMTP environment variables:
SMTP_HOST=smtp.gmail.com
SMTP_USERNAME=hey@gmail.com # your email
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@gmail.com
SMTP_FROM_NAME=Infisical
As per the notice by Google, you should note that using Gmail credentials for SMTP configuration will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
  1. Create an account and configure Office365 to send emails.
  2. With your login credentials, you can now set up your SMTP environment variables: 
SMTP_HOST=smtp.office365.com
SMTP_USERNAME=username@yourdomain.com # your username
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=username@yourdomain.com
SMTP_FROM_NAME=Infisical
  1. Create an account and configure Zoho Mail to send emails.
  2. With your email credentials, you can now set up your SMTP environment variables: 
SMTP_HOST=smtp.zoho.com
SMTP_USERNAME=username # your email
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
SMTP_FROM_NAME=Infisical
You can use either your personal Zoho email address like you@zohomail.com or a domain-based email address like you@yourdomain.com. If using a domain-based email address, then please make sure that you’ve configured and verified it with Zoho Mail.
Remember that you will need to restart Infisical for this to work properly.
  1. Create an account and configure SMTP2Go to send emails.
  2. Turn on SMTP authentication
SMTP_HOST=mail.smtp2go.com
SMTP_PORT=You can use one of the following ports: 2525, 80, 25, 8025, or 587
SMTP_USERNAME=username #Your SMTP2GO account's SMTP username
SMTP_PASSWORD=password #Your SMTP2GO account's SMTP password
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical
Optional (for TLS/SSL):TLS: Available on the same ports (2525, 80, 25, 8025, or 587) SSL: Available on ports 465, 8465, and 443

​
Authentication

By default, users can only login via email/password based login method. To login into Infisical with OAuth providers such as Google, configure the associated variables.
​
DEFAULT_SAML_ORG_SLUG
string
When set, all visits to the Infisical login page will automatically redirect users of your Infisical instance to the SAML identity provider associated with the specified organization slug.
Follow detailed guide to configure Google SSO
​
CLIENT_ID_GOOGLE_LOGIN
string
default:"none"
OAuth2 client ID for Google login
​
CLIENT_SECRET_GOOGLE_LOGIN
string
default:"none"
OAuth2 client secret for Google login
Follow detailed guide to configure GitHub SSO
​
CLIENT_ID_GITHUB_LOGIN
string
default:"none"
OAuth2 client ID for GitHub login
​
CLIENT_SECRET_GITHUB_LOGIN
string
default:"none"
OAuth2 client secret for GitHub login
Follow detailed guide to configure GitLab SSO
​
CLIENT_ID_GITLAB_LOGIN
string
default:"none"
OAuth2 client ID for GitLab login
​
CLIENT_SECRET_GITLAB_LOGIN
string
default:"none"
OAuth2 client secret for GitLab login
​
URL_GITLAB_LOGIN
string
default:"https://gitlab.com"
URL of your self-hosted instance of GitLab where the OAuth application is registered
Requires enterprise license. Please contact team@infisical.com to get more information.
Requires enterprise license. Please contact team@infisical.com to get more information.
Requires enterprise license. Please contact team@infisical.com to get more information.

​
App Connections

You can configure third-party app connections for re-use across Infisical Projects.
​
INF_APP_CONNECTION_AWS_ACCESS_KEY_ID
string
default:"none"
The AWS IAM User access key ID for assuming roles
​
INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY
string
default:"none"
The AWS IAM User secret key for assuming roles
​
INF_APP_CONNECTION_GITHUB_APP_ID
string
default:"none"
The ID of the GitHub App
​
INF_APP_CONNECTION_GITHUB_APP_SLUG
string
default:"none"
The slug of the GitHub App
​
INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID
string
default:"none"
The client ID for the GitHub App
​
INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET
string
default:"none"
The client secret for the GitHub App
​
INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY
string
default:"none"
The private key for the GitHub App
​
INF_APP_CONNECTION_GITHUB_RADAR_APP_ID
string
default:"none"
The ID of the GitHub Radar App
​
INF_APP_CONNECTION_GITHUB_RADAR_APP_SLUG
string
default:"none"
The slug of the GitHub Radar App
​
INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_ID
string
default:"none"
The client ID for the GitHub Radar App
​
INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_SECRET
string
default:"none"
The client secret for the GitHub Radar App
​
INF_APP_CONNECTION_GITHUB_RADAR_APP_PRIVATE_KEY
string
default:"none"
The private key for the GitHub Radar App
​
INF_APP_CONNECTION_GITHUB_RADAR_APP_WEBHOOK_SECRET
string
default:"none"
The webhook secret configured for payload verification in the GitHub Radar App
​
INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_ID
string
default:"none"
The OAuth2 client ID for GitHub OAuth Connection
​
INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_SECRET
string
default:"none"
The OAuth2 client secret for GitHub OAuth Connection
​
INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID
string
default:"none"
The Application ID of your GitLab OAuth application.
​
INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET
string
default:"none"
The Secret of your GitLab OAuth application.
​
INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID
string
default:"none"
The Application ID of your Heroku OAuth application.
​
INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET
string
default:"none"
The Secret of your Heroku OAuth application.

​
Native Secret Integrations

To help you sync secrets from Infisical to services such as Github and Gitlab, Infisical provides native integrations out of the box.
​
CLIENT_ID_HEROKU
string
default:"none"
OAuth2 client ID for Heroku integration
​
CLIENT_SECRET_HEROKU
string
default:"none"
OAuth2 client secret for Heroku integration
​
CLIENT_ID_VERCEL
string
default:"none"
OAuth2 client ID for Vercel integration
​
CLIENT_SECRET_VERCEL
string
default:"none"
OAuth2 client secret for Vercel integration
​
CLIENT_SLUG_VERCEL
string
default:"none"
OAuth2 slug for Vercel integration
​
CLIENT_ID_NETLIFY
string
default:"none"
OAuth2 client ID for Netlify integration
​
CLIENT_SECRET_NETLIFY
string
default:"none"
OAuth2 client secret for Netlify integration
​
CLIENT_ID_GITHUB
string
default:"none"
OAuth2 client ID for GitHub integration
​
CLIENT_SECRET_GITHUB
string
default:"none"
OAuth2 client secret for GitHub integration
​
CLIENT_ID_BITBUCKET
string
default:"none"
OAuth2 client ID for Bitbucket integration
​
CLIENT_SECRET_BITBUCKET
string
default:"none"
OAuth2 client secret for Bitbucket integration
​
CLIENT_ID_GCP_SECRET_MANAGER
string
default:"none"
OAuth2 client id for GCP secrets manager integration
​
CLIENT_SECRET_GCP_SECRET_MANAGER
string
default:"none"
OAuth2 client secret for GCP secrets manager integration
​
CLIENT_ID_AWS_INTEGRATION
string
default:"none"
The AWS IAM User access key for assuming roles.
​
CLIENT_SECRET_AWS_INTEGRATION
string
default:"none"
The AWS IAM User secret key for assuming roles.
​
CLIENT_ID_AZURE
string
default:"none"
OAuth2 client id for Azure integration
​
CLIENT_SECRET_AZURE
string
default:"none"
OAuth2 client secret for Azure integration
​
CLIENT_ID_GITLAB
string
default:"none"
OAuth2 client id for Gitlab integration
​
CLIENT_SECRET_GITLAB
string
default:"none"
OAuth2 client secret for Gitlab integration

​
Secret Scanning

​
SECRET_SCANNING_GIT_APP_ID
string
default:"none"
The App ID of your GitHub App.
​
SECRET_SCANNING_GIT_APP_SLUG
string
default:"none"
The slug of your GitHub App.
​
SECRET_SCANNING_PRIVATE_KEY
string
default:"none"
A private key for your GitHub App.
​
SECRET_SCANNING_WEBHOOK_SECRET
string
default:"none"
The webhook secret of your GitHub App.

​
Observability

You can configure Infisical to collect and expose telemetry data for analytics and monitoring.
​
OTEL_TELEMETRY_COLLECTION_ENABLED
string
default:"false"
Whether or not to collect and expose telemetry data.
​
OTEL_EXPORT_TYPE
enum
Supported types are prometheus and otlp.If export type is set to prometheus, metric data will be exposed in port 9464 in the /metrics path.If export type is set to otlp, you will have to configure a value for OTEL_EXPORT_OTLP_ENDPOINT.
​
OTEL_EXPORT_OTLP_ENDPOINT
string
Where telemetry data would be pushed to for collection. This is only applicable when OTEL_EXPORT_TYPE is set to otlp.
​
OTEL_COLLECTOR_BASIC_AUTH_USERNAME
string
The username for authenticating with the telemetry collector.
​
OTEL_COLLECTOR_BASIC_AUTH_PASSWORD
string
The password for authenticating with the telemetry collector.

​
Identity Auth Method

​
IDENTITY_TLS_CERT_AUTH_CLIENT_CERTIFICATE_HEADER_KEY
string
default:"x-identity-tls-cert-auth-client-cert"
The TLS header used to propagate the client certificate from the load balancer to the server.

​
Environment Variable Overrides

If you can’t directly access and modify environment variables, you can update them using the Server Admin Console. Environment Variables Overrides Page