Infisical logo

Deploy Infisical

Your own secrets manager, claimed at deploy

SecurityDevelopmentWorkInfisical + PostgreSQL + Valkey + Email

Deploy Infisical with managed PostgreSQL, Valkey for its job queues, invitation emails that send, and a public HTTPS URL. The admin account is created with a generated password before the app is reachable, and public sign-up is closed, so nobody else can claim your instance. Keep every environment’s secrets in one place and give CI and servers their own machine identities.

What you get with Infisical

  • Encrypted secrets per environmentEach project gets Development, Staging and Production out of the box. Values are encrypted at rest with a key generated for your deploy.
  • Projects, folders and tagsGroup secrets by service, nest them in folders, tag and comment them, and paste a whole .env file to import it in one go.
  • Versions and commitsEvery change is committed with its author, and each secret keeps its version history, so you can see what changed and when.
  • Machine identities for CI and serversGive pipelines and workloads their own identity with a client ID and secret, scoped to the projects and role you choose, such as read only.
  • Invite your teamAdd people from Access Control. Invitations go out through the Email add-on, and each member gets a role per organization and project.
  • Closed from the first secondNo setup page for strangers: the admin is created at first start, sign-up is invite only, login is email only and anonymous secret sharing is off.

After you deploy Infisical

  1. 1Sign in as the adminOpen your app URL and sign in with INFISICAL_ADMIN_EMAIL and the generated INFISICAL_ADMIN_PASSWORD from the app’s Variables. A short setup asks for your name and organization.
  2. 2Make the account yoursChange the admin email to your own address in Personal Settings and set a new password, then invite your team from Access Control.
  3. 3Add secrets and connect your appsCreate a project, add or paste your secrets per environment, and create a machine identity for each pipeline or server that needs to read them.

How Infisical is wired

Infisical, PostgreSQL, Valkey and the Email add-on ship together. The public hostname serves the web app and the API your machine identities call. Nothing is stored on a volume: secrets and settings live in PostgreSQL.

PostgreSQL holds the secrets
Projects, encrypted secret values, versions and identities live in the attached PostgreSQL database, with passwords generated at deploy. Redeploys keep everything.
Valkey runs the queues
Background jobs such as reminders, syncs and cleanups run through queues in the Valkey add-on, next to the app.
Your encryption key
ENCRYPTION_KEY is generated for your deploy and wraps every stored secret. Keep a copy somewhere safe: data encrypted with it can’t be read without it.
Mail goes through the Email add-on
Invitations, password resets and new-device notices send through the platform relay from your project’s sending address. There is no mail server to set up.

Why run Infisical on StackBlaze

  • Scale your appChange CPU, RAM, and replicas without a rebuild, or let autoscaling add replicas when CPU climbs.
  • Git-based CI/CDPush to GitHub and it builds and ships. Pull requests get their own preview URL on Pro and Business.
  • One-click rollbackA deploy went wrong? Go back to any previous successful deploy.
  • Environments built inProduction, staging, and dev as separate environments in one project, each with its own URL.
  • Built-in observabilityCPU, memory, and response time per app, live logs with search, and alerts to Slack, Discord, or a webhook.
  • Developer-first toolsA CLI and Stack MCP: deploy, read logs, and wire services from your terminal or your AI assistant.
  • Built for teamsInvite teammates with roles. An audit log records who changed what.
  • Managed Postgres with HAPostgres is run for you. Turn on high availability for a three-node cluster when the app needs it.

Common questions about Infisical

How do I sign in the first time?

Open your app URL and sign in with INFISICAL_ADMIN_EMAIL (admin@example.com) and INFISICAL_ADMIN_PASSWORD from the app’s Variables. The account is created when the app first starts, before it is reachable, so the admin setup page is never open to visitors. Change the email to your own afterwards.

Can anyone sign up on my instance?

No. Sign-up is invite only and login is by email and password. You can allow sign-up for your own email domain, or turn on other login methods, in the Server Console.

Which features are included?

This is the free self-hosted edition: projects, environments, folders, versions, machine identities, invitations and secret sharing for signed-in users. Features such as SAML or OIDC single sign-on, custom roles, audit logs, approvals, secret rotation and dynamic secrets need a license key from Infisical.

How do my apps and pipelines read secrets?

Create a machine identity in Access Control, add universal auth to get a client ID and secret, and give it a role on the projects it needs. Your pipeline logs in with those and reads only what that role allows.

Where is my data stored?

In the attached PostgreSQL database, encrypted with the ENCRYPTION_KEY generated for your deploy. Valkey only holds job queues and cache. Both stay when you redeploy.

Can I use my own domain?

Yes. Attach a custom domain from the dashboard, for example secrets.example.com, and set SITE_URL to the new https address so links in emails use it. Custom domains

What does it cost?

You pay for the compute, storage and bandwidth Infisical, PostgreSQL and Valkey use, and for the emails it sends, not per user. Pricing

More Security templates

Browse all templates