Environment Variables

Infisical accepts all configuration via environment variables. For a minimal self-hosted instance, at least ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI, and REDIS_URL must be defined. However, you can configure additional settings to activate more features as needed.

General platform

Used to configure platform-specific security and operational settings.

string

default:"none"

required

Must be a random 16-byte hex string. Can be generated with openssl rand -hex 16.

For FIPS-enabled deployments, ENCRYPTION_KEY must be a 256-bit base64-encoded key instead. Generate it with openssl rand -base64 32.

string

default:"none"

required

Must be a random 32-byte base64 string. Can be generated with openssl rand -base64 32.

string

default:"none"

required

Must be an absolute URL including the protocol (e.g. https://app.infisical.com).

int

default:"8080"

Specifies the internal port on which the application listens.

string

default:"localhost"

Specifies the network interface Infisical will bind to when accepting incoming connections.By default, Infisical binds to localhost, which restricts access to connections from the same machine.To make the application accessible externally (e.g., for self-hosted deployments), set this to 0.0.0.0, which tells the server to listen on all network interfaces.Example values:

localhost (default, same as 127.0.0.1)
0.0.0.0 (all interfaces, accessible externally)
192.168.1.100 (specific interface IP)

string

default:"true"

Telemetry helps us improve Infisical, but if you want to disable it, you may set this to false.

bool

default:"false"

Determines whether App Connections, Dynamic Secrets, and PKI Certificate Discovery jobs are permitted to connect with internal/private IP addresses.

bool

default:"false"

Determines whether your Infisical instance can automatically read the service account token of the pod it’s running on. Used for features such as the IRSA auth method.

string

Comma-separated list of trusted reverse-proxy CIDRs or named ranges whose forwarded-IP headers (e.g. X-Forwarded-For) Infisical will honor.Accepted values are IPv4/IPv6 CIDR notation or the named aliases loopback, linklocal, and uniquelocal.

TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

When set, only requests arriving from a socket address within this list will have their forwarded-IP headers respected. Requests from any other source fall back to using the raw socket IP. This prevents IP allowlist bypass via spoofed proxy headers.When unset, Infisical trusts all forwarded-IP headers (legacy behavior, preserved for backwards compatibility with existing self-hosted deployments).

If your deployment sits behind a reverse proxy (e.g. Nginx, AWS ALB, Cloudflare), you should set this to the CIDR range of your proxy to prevent clients from spoofing their source IP. Leaving this unset is only safe when Infisical is not reachable directly from the internet.

CORS

Cross-Origin Resource Sharing (CORS) is a security feature that allows web applications running on one domain to access resources from another domain. The following environment variables can be used to configure the Infisical REST API to allow or restrict access to resources from different origins.

string

Specify a list of origins that are allowed to access the Infisical API.An example value would be CORS_ALLOWED_ORIGINS=["https://example.com"].Defaults to the same value as your SITE_URL environment variable.

string

Array of HTTP methods allowed for CORS requests.Defaults to reflecting the headers specified in the request’s Access-Control-Request-Headers header.

Data Layer

The platform uses Postgres to persist all of its data and Redis for caching and background tasks.

PostgreSQL

Please note that the database user you create must be granted all privileges on the Infisical database. This includes the ability to create new schemas, create, update, delete, modify tables and indexes, etc.

string

default:""

required

Postgres database connection string.

string

default:""

Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. Use the following command to encode your certificate: echo "<certificate>" | base64Many cloud providers provide a CA certificate for their data regions that you can use to secure your connection with SSL.

AWS RDS

If you’re hosting your database on AWS RDS, you can use their publicly available CA certificate as the database root certificate.You can find all the available CA certificates for AWS RDS on the official AWS RDS documentation.As an example, if your RDS cluster is hosted in us-east-1 (US East, N. Virginia), you can use the following root certificate: https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem.All the available CA certificates can be found in the AWS RDS documentation linked above.Remember to base64 encode the certificate before setting it as the DB_ROOT_CERT environment variable. cat /path/to/certificate.pem | base64.

DB_ROOT_CERT=LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1 # .... (base64-encoded certificate)
DB_CONNECTION_URI=<rds-endpoint>?sslmode=verify-ca # or verify-full depending on your security policies

string

default:""

Postgres database read replica connection strings. It accepts a JSON string.

DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]

Show Format

string

default:""

required

Postgres read replica connection string.

string

default:""

Configure the SSL certificate for securing a Postgres replica connection by first encoding it in base64. Use the following command to encode your certificate: echo "<certificate>" | base64If not provided it will use master SSL certificate.

Audit Log PostgreSQL (Optional)

string

Separate PostgreSQL connection string for audit log storage. If not set, audit logs are stored in the main database.

string

Base64-encoded CA certificate for the audit log PostgreSQL database connection. Only needed if AUDIT_LOGS_DB_CONNECTION_URI is set.

ClickHouse (Optional)

ClickHouse can be used as an alternative audit log storage backend for high-volume deployments. See the ClickHouse Setup Guide for more details.

string

ClickHouse connection URL. Example: http://user:password@host:8123/database

string

default:"true"

Enable inserting audit logs into ClickHouse. Defaults to true when CLICKHOUSE_URL is set.

string

default:"audit_logs"

ClickHouse table name for audit logs.

string

default:"ReplacingMergeTree"

ClickHouse engine for the audit logs table, used during table creation. Example: ReplacingMergeTree or SharedReplacingMergeTree('/clickhouse/tables/{uuid}/{shard}', '{replica}').

string

ClickHouse insert settings as a JSON string. Applied when inserting audit logs.Default: {"async_insert":1,"wait_for_async_insert":0,"date_time_input_format":"best_effort"}

Audit Log Behavior

string

default:"false"

Disable storing audit logs in PostgreSQL. When set to true, audit logs are not written to PostgreSQL but are still sent to ClickHouse (if configured) and any configured audit log streams.

string

default:"true"

Enable sending audit logs to external audit log streams. When set to false, no events are sent to configured stream destinations, but PostgreSQL and ClickHouse storage are unaffected.

string

default:"false"

Disable audit log generation entirely. When set to true, no audit log events are produced — neither PostgreSQL, ClickHouse, nor audit log streams will receive events.

Redis

Redis is used for caching and background tasks. You can use either a standalone Redis instance, Redis Sentinel, or Redis Cluster setup.

An active-passive setup is recommended for Redis. Infisical has not been tested with an active-active Redis setup, which may result in undocumented behavior.

Redis Standalone
Redis Sentinel
Redis Cluster
Redis Read Replica

string

default:"none"

required

Redis connection string. For SSL/TLS connections, use the rediss:// protocol (note the double ‘s’).Examples:

Without SSL: redis://localhost:6379
With SSL: rediss://localhost:6379
With authentication: redis://:password@localhost:6379
With SSL and authentication: rediss://:password@localhost:6379

string

default:"none"

required

Comma-separated list of Sentinel host:port pairs. 192.168.65.254:26379,192.168.65.254:26380

string

default:"mymaster"

The name of the Redis master set monitored by Sentinel

bool

default:"false"

Whether to use TLS/SSL for Redis Sentinel connection

string

default:"none"

Authentication username for Redis Sentinel

string

default:"none"

Authentication password for Redis Sentinel

string

default:"none"

Authentication username for Redis Node

string

default:"none"

Authentication password for Redis Node

string

default:"none"

required

Comma-separated list of Redis Cluster host:port pairs. 192.168.65.254:26379,192.168.65.254:26380

boolean

default:"false"

Enable Redis TLS encryption on connection.

boolean

default:"false"

Enable this if you are using in-transit encryption for an AWS ElastiCache cluster. For more information, refer to the ioredis documentation.

string

default:"none"

Authentication username for Redis Node

string

default:"none"

Authentication password for Redis Node

string

default:"none"

Comma-separated list of Redis read replicas host:port pairs. 192.168.65.254:26379,192.168.65.254:26380

Parameters such as username, password, TLS, and Redis type are inherited from the primary instance.

Redis with SSL/TLS

To connect to Redis with SSL/TLS, use the rediss:// protocol (note the double ‘s’) in your connection string. If your Redis server uses a certificate signed by a private CA or a self-signed certificate, set the NODE_EXTRA_CA_CERTS environment variable to the path of your CA certificate file:

REDIS_URL=rediss://your-redis-host:6379
NODE_EXTRA_CA_CERTS=/path/to/ca.crt

For Redis Sentinel or Cluster mode, use the REDIS_SENTINEL_ENABLE_TLS or REDIS_CLUSTER_ENABLE_TLS environment variables respectively.

Email Service

Without email configuration, Infisical’s core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.

Generic Configuration

string

default:"none"

Hostname to connect to for establishing SMTP connections

string

default:"587"

Port to connect to for establishing SMTP connections

string

default:"none"

Credential to connect to host (e.g. you@example.com)

string

default:"none"

Credential to connect to host

string

default:"none"

Email address to be used for sending emails

string

default:"none"

Name label to be used in From field (e.g. Team)

string

default:"none"

Hostname that Infisical announces in the SMTP EHLO/HELO greeting. When unset, the underlying mailer falls back to the operating system hostname. Inside containers (e.g. Cloud Run, Kubernetes) the OS hostname is typically a random container ID, which can be rejected by SMTP relays that validate the sender hostname (such as Gmail SMTP relay with sender-hostname checks). Set this to a valid FQDN that the relay accepts.

bool

default:"false"

If this is true and SMTP_PORT is not 465 then TLS is not used even if the server supports STARTTLS extension.

bool

default:"true"

If this is true and SMTP_PORT is not 465 then Infisical tries to use STARTTLS even if the server does not advertise support for it. If the connection cannot be encrypted, then the message is not sent.

bool

default:"true"

If this is true, Infisical will validate the server’s SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to false, the client will accept the server’s certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.

string

default:"none"

If your SMTP server uses a certificate signed by a custom Certificate Authority, you should set this variable so that Infisical can trust the custom CA.This variable must be a base64-encoded PEM certificate. Use the following command to encode your certificate: echo "<certificate>" | base64Infisical strongly recommends using the following variables alongside this one for maximum security:

SMTP_REQUIRE_TLS=true
SMTP_TLS_REJECT_UNAUTHORIZED=true

Twilio SendGrid

Create an account and configure SendGrid to send emails.
Create a SendGrid API Key under Settings > API Keys
Set a name for your API Key, we recommend using “Infisical,” and select the “Restricted Key” option. You will need to enable the “Mail Send” permission as shown below:

With the API Key, you can now set your SMTP environment variables:

SMTP_HOST=smtp.sendgrid.net
SMTP_USERNAME=apikey
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

Remember that you will need to restart Infisical for this to work properly.

Mailgun

Create an account and configure Mailgun to send emails.
Obtain your Mailgun credentials in Sending > Overview > SMTP

With your Mailgun credentials, you can now set up your SMTP environment variables:

SMTP_HOST=smtp.mailgun.org # obtained from credentials page
SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
SMTP_PASSWORD=password # obtained from credentials page
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

AWS SES

Create a verified identity

This will be used to verify the email you are sending from. Create SES identity

If AWS SES is in sandbox mode, you will only be able to send emails to verified identities.

Create an account and configure AWS SES

Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentials opening AWS SES console

Set up your SMTP environment variables

With your AWS SES SMTP credentials, you can now set up your SMTP environment variables for your Infisical instance.

SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settings
SMTP_USERNAME=xxx # your SMTP username
SMTP_PASSWORD=xxx # your SMTP password
SMTP_PORT=465
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

Remember that you will need to restart Infisical for this to work properly.

SocketLabs

Create an account and configure SocketLabs to send emails.
From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.

With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:

SMTP_HOST=smtp.socketlabs.com
SMTP_USERNAME=username # obtained from your credentials
SMTP_PASSWORD=password # obtained from your credentials
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

The SMTP_FROM_ADDRESS environment variable should be an email for an authenticated domain under Configuration > Domain Management in SocketLabs. For example, if you’re using SocketLabs in sandbox mode, then you may use an email like team@sandbox.socketlabs.dev.

Remember that you will need to restart Infisical for this to work properly.

Resend

Create an account on Resend.
Add a Domain.

Create an API Key.

Go to the SMTP page and copy the values.

With the API Key, you can now set your SMTP environment variables:

SMTP_HOST=smtp.resend.com
SMTP_USERNAME=resend
SMTP_PASSWORD=YOUR_API_KEY
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

Remember that you will need to restart Infisical for this to work properly.

Gmail

Create an account and enable “less secure app access” in Gmail Account Settings > Security. This will allow applications like Infisical to authenticate with Gmail via your username and password. Gmail secure app access

With your Gmail username and password, you can set your SMTP environment variables:

SMTP_HOST=smtp.gmail.com
SMTP_USERNAME=hey@gmail.com # your email
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@gmail.com
SMTP_FROM_NAME=Infisical

As per the notice by Google, you should note that using Gmail credentials for SMTP configuration will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.

Office365

Create an account and configure Office365 to send emails.
With your login credentials, you can now set up your SMTP environment variables:

SMTP_HOST=smtp.office365.com
SMTP_USERNAME=username@yourdomain.com # your username
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=username@yourdomain.com
SMTP_FROM_NAME=Infisical

Zoho Mail

Create an account and configure Zoho Mail to send emails.
With your email credentials, you can now set up your SMTP environment variables:

SMTP_HOST=smtp.zoho.com
SMTP_USERNAME=username # your email
SMTP_PASSWORD=password # your password
SMTP_PORT=587
SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
SMTP_FROM_NAME=Infisical

You can use either your personal Zoho email address like you@zohomail.com or a domain-based email address like you@yourdomain.com. If using a domain-based email address, then please make sure that you’ve configured and verified it with Zoho Mail.

Remember that you will need to restart Infisical for this to work properly.

SMTP2Go

Create an account and configure SMTP2Go to send emails.
Turn on SMTP authentication

SMTP_HOST=mail.smtp2go.com
SMTP_PORT=You can use one of the following ports: 2525, 80, 25, 8025, or 587
SMTP_USERNAME=username #Your SMTP2GO account's SMTP username
SMTP_PASSWORD=password #Your SMTP2GO account's SMTP password
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
SMTP_FROM_NAME=Infisical

Optional (for TLS/SSL):TLS: Available on the same ports (2525, 80, 25, 8025, or 587) SSL: Available on ports 465, 8465, and 443

Authentication

By default, users can only log in via the email/password-based login method. To log in to Infisical with OAuth providers such as Google, configure the associated variables.

string

When set, all visits to the Infisical login page will automatically redirect users of your Infisical instance to the SAML identity provider associated with the specified organization slug.

Google

Follow the detailed guide to configure Google SSO.

OAuth2 client ID for Google login

OAuth2 client secret for Google login

GitHub

Follow the detailed guide to configure GitHub SSO.

OAuth2 client ID for GitHub login

OAuth2 client secret for GitHub login

GitLab

Follow the detailed guide to configure GitLab SSO.

OAuth2 client ID for GitLab login

OAuth2 client secret for GitLab login

URL of your self-hosted instance of GitLab where the OAuth application is registered

Okta SAML

Requires enterprise license. Please contact sales@infisical.com to get more information.

Azure SAML

Requires enterprise license. Please contact sales@infisical.com to get more information.

JumpCloud SAML

Requires enterprise license. Please contact sales@infisical.com to get more information.

App Connections

You can configure third-party app connections for re-use across Infisical Projects.

AWS Assume Role Connection

string

default:"none"

The AWS IAM User access key ID for assuming roles

string

default:"none"

The AWS IAM User secret key for assuming roles

GitHub App Connection

string

default:"none"

The ID of the GitHub App

string

default:"none"

The slug of the GitHub App

string

default:"none"

The client ID for the GitHub App

string

default:"none"

The client secret for the GitHub App

string

default:"none"

The private key for the GitHub App

string

default:"github.com"

The hostname of the GitHub instance where the shared GitHub App is registered. Only required when the shared GitHub App is registered on a GitHub Enterprise Server (GHES) instance rather than github.com (e.g. github.mycompany.com). Defaults to github.com when not set.

GitHub Radar App Connection

string

default:"none"

The ID of the GitHub Radar App

string

default:"none"

The slug of the GitHub Radar App

string

default:"none"

The client ID for the GitHub Radar App

string

default:"none"

The client secret for the GitHub Radar App

string

default:"none"

The private key for the GitHub Radar App

string

default:"none"

The webhook secret configured for payload verification in the GitHub Radar App

GitHub OAuth Connection

string

default:"none"

The OAuth2 client ID for GitHub OAuth Connection

string

default:"none"

The OAuth2 client secret for GitHub OAuth Connection

GitLab OAuth Connection

string

default:"none"

The Application ID of your GitLab OAuth application.

string

default:"none"

The Secret of your GitLab OAuth application.

Heroku OAuth Connection

string

default:"none"

The Application ID of your Heroku OAuth application.

string

default:"none"

The Secret of your Heroku OAuth application.

Secret Scanning

GitHub

string

default:"none"

The App ID of your GitHub App.

string

default:"none"

The slug of your GitHub App.

string

default:"none"

A private key for your GitHub App.

string

default:"none"

The webhook secret of your GitHub App.

Observability

You can configure Infisical to collect and expose telemetry data for analytics and monitoring.

string

default:"false"

Whether to collect and expose telemetry data.

enum

Supported types are prometheus and otlp.If the export type is set to prometheus, metric data will be exposed on port 9464 at the /metrics path.If the export type is set to otlp, you will have to configure a value for OTEL_EXPORT_OTLP_ENDPOINT.

string

Where telemetry data is pushed for collection. This is only applicable when OTEL_EXPORT_TYPE is set to otlp.

string

The username for authenticating with the telemetry collector.

string

The password for authenticating with the telemetry collector.

string

default:"false"

When set to true, the SDK discards all data points from the high-cardinality, per-actor Infisical, API, SecretSyncs, PkiSyncs, and Integrations meters before aggregation. The instruments still exist in code (no errors), but nothing is stored or exported. Only bounded-cardinality InfisicalCore metrics are emitted. Useful for large or multi-tenant deployments where per-actor label cardinality is too expensive. See Monitoring & Telemetry for details.

Identity Auth Method

string

default:"x-identity-tls-cert-auth-client-cert"

The TLS header used to propagate the client certificate from the load balancer to the server.

Environment Variable Overrides

If you can’t directly access and modify environment variables, you can update them using the Server Admin Console. Environment Variables Overrides Page

Getting Started

Platform Reference

Connectivity

Authentication Methods

Self-host Infisical

Internals

Contributing

Environment Variables

General platform

CORS

Data Layer

PostgreSQL

Audit Log PostgreSQL (Optional)

ClickHouse (Optional)

Audit Log Behavior

Redis

Redis with SSL/TLS

Email Service

Authentication

App Connections

Secret Scanning

Observability

Identity Auth Method

Environment Variable Overrides

​General platform

​CORS

​Data Layer

​PostgreSQL

​Audit Log PostgreSQL (Optional)

​ClickHouse (Optional)

​Audit Log Behavior

​Redis

​Redis with SSL/TLS

​Email Service

​Authentication

​App Connections

​Secret Scanning

​Observability

​Identity Auth Method

​Environment Variable Overrides

General platform

CORS

Data Layer

PostgreSQL

Audit Log PostgreSQL (Optional)

ClickHouse (Optional)

Audit Log Behavior

Redis

Redis with SSL/TLS

Email Service

Authentication

App Connections

Secret Scanning

Observability

Identity Auth Method

Environment Variable Overrides