DEV Community

Alex Spinov
Alex Spinov

Posted on

Infisical Has a Free API: The Open-Source Secrets Manager That Replaces .env Files Across Your Entire Team

#infisical #api #security #devops

Your team shares secrets in Slack DMs, .env files in Dropbox, and API keys in plaintext Notion docs. One leaked key and you are in trouble. Infisical centralizes all your secrets with encryption, access control, and automatic rotation.

What Is Infisical?

Infisical is an open-source secrets management platform. It replaces .env files with a centralized, encrypted secret store. Your team manages secrets through a dashboard, and your apps fetch them through the CLI, SDK, or API.

The Free API

Infisical Cloud offers a generous free tier:

  • Free plan: Unlimited secrets, 5 team members
  • E2E encryption: Secrets encrypted before leaving your browser
  • REST API: Full CRUD for secrets programmatically
  • SDKs: Node.js, Python, Go, Java, .NET
  • CLI: Inject secrets into any process
  • Integrations: GitHub Actions, Vercel, AWS, Docker, Kubernetes
  • Secret rotation: Automatic key rotation
  • Audit logs: Track who accessed what

Quick Start

Install the CLI:

# macOS
brew install infisical/get-cli/infisical

# npm
npm install -g @infisical/cli
Enter fullscreen mode Exit fullscreen mode

Login and initialize:

infisical login
infisical init  # Links to your project
Enter fullscreen mode Exit fullscreen mode

Inject secrets into any command:

# Run your app with secrets injected as env vars
infisical run -- npm run dev

# Run with specific environment
infisical run --env=production -- node server.js

# Export secrets
infisical export --format=dotenv > .env
Enter fullscreen mode Exit fullscreen mode

Use the Node.js SDK:

import { InfisicalClient } from '@infisical/sdk';

const client = new InfisicalClient({
  siteUrl: 'https://app.infisical.com',
  auth: {
    universalAuth: {
      clientId: process.env.INFISICAL_CLIENT_ID,
      clientSecret: process.env.INFISICAL_CLIENT_SECRET,
    }
  }
});

// Get a single secret
const secret = await client.getSecret({
  environment: 'production',
  projectId: 'your-project-id',
  secretName: 'DATABASE_URL',
});

console.log(secret.secretValue);

// List all secrets
const secrets = await client.listSecrets({
  environment: 'production',
  projectId: 'your-project-id',
});
Enter fullscreen mode Exit fullscreen mode

In GitHub Actions:

- uses: Infisical/secrets-action@v1
  with:
    method: universal-auth
    client-id: ${{ secrets.INFISICAL_CLIENT_ID }}
    client-secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
    project-slug: my-project
    env-slug: production
Enter fullscreen mode Exit fullscreen mode

Why Teams Choose Infisical

A startup stored API keys in a shared .env file on Google Drive. A contractor accidentally committed it to a public GitHub repo. By the time they noticed, their AWS bill was $4,000 from crypto miners. After switching to Infisical, secrets never touched developer machines — the CLI injected them at runtime, and access was revoked instantly when the contractor left.

Who Is This For?

  • Development teams sharing secrets through insecure channels
  • DevOps engineers managing secrets across environments
  • Security teams needing audit trails for secret access
  • Startups wanting enterprise secret management without enterprise pricing

Start Managing Secrets Properly

Infisical makes secrets management as easy as .env files but actually secure. Encryption, access control, rotation, and audit logs — all in one open-source platform.

Need help with security infrastructure or secrets management? I build custom DevOps solutions — reach out to discuss your project.

Found this useful? I publish daily deep-dives into developer tools and APIs. Follow for more.

Top comments (0)