wif.tax

Infisical

B Infisical Cloud (secrets management platform)

Machine identities can log in with a JWT from any OIDC issuer you configure, constrained by subject, audience and claims, so no Infisical secret is needed. Into your clouds it assumes an AWS role with external ID, impersonates a GCP service account, and installs as a GitHub or Azure app, but Okta, Entra ID, Salesforce and most SaaS connectors still want a pasted token or secret.

Docs: infisical.com · Checked 2026-10-13 · source YAML · dispute via PR

Inbound A

How a workload running anywhere authenticates to this product.

OIDC Auth on a machine identity: the workload presents a JWT from any OIDC issuer (discovery URL + issuer configured by the customer), Infisical checks subject, audiences and claims and returns a short-lived access token.

Issuers
any

Besides OIDC Auth, machine identities support JWT Auth (static keys or JWKS), SPIFFE, TLS certificate, LDAP, and cloud-native AWS/GCP/Azure/Kubernetes/OCI/AliCloud auth. Universal Auth (client ID + client secret) is the default method on a new identity and Token Auth issues manually created access tokens; both are the static credentials scored by the hygiene checks. Subject/audience/claims fields accept globs, and Infisical warns that "*" also matches ":" and "/", so loose patterns can over-trust a shared issuer such as GitHub Actions. Access tokens returned by OIDC Auth default to a 30-day TTL, which is long for a "short-lived" token; tune it down. The self-hosted Gateway enrolls with a one-time 1-hour token by default, or keylessly via AWS STS, GCP metadata or Kubernetes service account tokens. No tier gate on OIDC Auth was found on the public pricing page; trusted-IP restrictions on tokens are a paid (Pro) feature.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

App Connections: AWS cross-account Assume Role with required external ID, GCP service account impersonation by Infisical's own service account, Azure OAuth consent to Infisical's shared app registration, and a GitHub App install are keyless; Okta (API token), Entra ID (client secret), Salesforce (client credentials), Cloudflare, Vercel and most other SaaS connectors take a customer-created static credential.

Connectors checked: AWS (Assume Role recommended; access-key option also offered), GCP (impersonation; Infisical Cloud uses its own service account, self-hosters upload a JSON key or use WIF for the instance), Azure Key Vault / App Configuration (OAuth to Infisical's app is keyless; client secret and certificate options also offered), GitHub (GitHub App recommended; OAuth and PAT options exist), GitLab (access token on Cloud; OAuth is self-hosted only), Okta (API token only), Azure Entra ID (client secret only, with optional automatic rotation), Azure Client Secrets (OAuth or client secret), Salesforce (customer-created External Client App with consumer key/secret), OCI (access key), Cloudflare and Vercel (API tokens). No Google Workspace or M365 connector was found. Many SaaS targets (Vercel, Netlify, Cloudflare, etc.) only offer static tokens themselves, and several connectors can rotate the credential they were given. Keyless on all three clouds and GitHub but static on Okta/Entra/Salesforce, so B.

Hygiene for any static credential the product still issues

✗ Expiry enforceable
Client secrets can be given a TTL and a max number of uses, and credential-expiry alerts exist, but the default is never-expire and no org policy forcing a maximum client secret TTL is documented. Token Auth tokens default to a 30-day TTL but accept up to 315360000 seconds (ten years).
  • infisical.com checked 2026-10-13
    “By default, the TTL will be set to 0 which implies that the Client Secret will never expire; a value of 0 implies an infinite lifetime.”
  • infisical.com checked 2026-10-13
    “If the TTL is 0 (the default), the secret never expires, and the alert ignores it.”
✓ Rotation via API
  • infisical.com checked 2026-10-13
    “Create Universal Auth Client Secret for machine identity”
  • infisical.com checked 2026-10-13
    “Revoke Universal Auth Client Secrets for machine identity”
✓ Scoped keys
Client secrets belong to a purpose-built machine identity with its own org and project roles (built-in or custom); client secrets and tokens can also be restricted to trusted IPs on paid plans.
  • infisical.com checked 2026-10-13
    “Each machine identity has a role that controls what the identity can access, and one or more auth methods.”
✓ Last-used visible
Token Auth tokens expose accessTokenLastUsedAt and identities expose lastLoginTime and lastLoginAuthMethod in the OpenAPI spec. Universal Auth client secrets themselves have no last-used timestamp, only a use counter (clientSecretNumUses), so finding a dead client secret on an identity with several secrets is indirect. Generous pass.
  • app.infisical.com checked 2026-10-13
    “"accessTokenLastUsedAt": {"type": "string", "format": "date-time", "nullable": true}”
  • app.infisical.com checked 2026-10-13
    “"lastLoginTime": {"type": "string", "format": "date-time", "nullable": true}”
✗ Leak revocation
Infisical does not appear in GitHub's supported secret-scanning patterns, partner or user, while competitor Doppler does. Infisical sells its own secret-scanning product, but that does not revoke a leaked Infisical client secret pushed to a public GitHub repo.

Notes

Graded Infisical Cloud. The same platform also covers PKI, KMS, PAM and Agent Vault under the same machine-identity auth. Legacy service tokens still appear in the API (/api/v2/service-token) but machine identities are the documented path. Self-hosted instances need their own cloud credentials (an AWS access key or instance role, a GCP JSON key or WIF) to make the outbound connectors work.

Badge

wif.tax grade B

[![wif.tax grade](https://wif.tax/badge/infisical-secrets.svg)](https://wif.tax/p/infisical-secrets/)