awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

documentation revamp

Browse Source
This commit is contained in:
Vladyslav Matsiiako
2024-03-31 23:37:57 -07:00
parent 4323407da7
commit f623c8159d
93 changed files with 767 additions and 384 deletions
Download Patch File Download Diff File Expand all files Collapse all files

130
docs/documentation/getting-started/introduction.mdx
View File

@@ -1,99 +1,97 @@
---
title: "Introduction"
title: "What is Infisical?"
sidebarTitle: "What is Infisical?"
description: "An Introduction to the Infisical secret management platform."
---
Infisical is an [open-source](https://opensource.com/resources/what-open-source), [end-to-end encrypted](https://en.wikipedia.org/wiki/End-to-end_encryption) secrets management platform for storing, managing, and syncing
application configuration and secrets like API keys, database credentials, and environment variables across applications and infrastructure.
Infisical is an [open-source](https://github.com/infisical/infisical) secret management platform for developers.
It provides capabilities for storing, managing, and syncing application configuration and secrets like API keys, database
credentials, and certificates across infrastructure. In addition, Infisical prevents secrets leaks to git and enables secure
sharing of secrets among engineers.
Start syncing environment variables with [Infisical Cloud](https://app.infisical.com) or learn how to [host Infisical](/self-hosting/overview) yourself.
## Learn about Infisical
<Card
href="/documentation/getting-started/platform"
title="Platform"
icon="laptop"
color="#dc2626"
>
Store secrets like API keys, database credentials, environment variables with Infisical
</Card>
## Access secrets
Start managing secrets securely with [Infisical Cloud](https://app.infisical.com) or learn how to [host Infisical](/self-hosting/overview) yourself.
<CardGroup cols={2}>
<Card href="../../cli/overview" title="Command Line Interface (CLI)" icon="square-terminal" color="#3775a9">
Inject secrets into any application process/environment
<Card
title="Infisical Cloud"
href="https://app.infisical.com/signup"
icon="cloud"
color="#000000"
>
Get started with Infisical Cloud in just a few minutes.
</Card>
<Card
href="/self-hosting/overview"
title="Self-hosting"
icon="server"
color="#000000"
>
Self-host Infisical on your own infrastructure.
</Card>
</CardGroup>
## Why Infisical?
Infisical helps developers achieve secure centralized secret management and provides all the tools to easily manage secrets in various environments and infrastructure components. In particular, here are some of the most common points that developers mention after adopting Infisical:
- Streamlined **local development** processes (switching .env files to [Infisical CLI](/cli/commands/run) and removing secrets from developer machines).
- **Best-in-class developer experience** with an easy-to-use [Web Dashboard](/documentation/platform/project).
- Simple secret management inside **[CI/CD pipelines](/integrations/cicd/githubactions)** and staging environments.
- Secure and compliant secret management practices in **[production environments](/sdks/overview)**.
- **Facilitated workflows** around [secret change management](/documentation/platform/pr-workflows), [access requests](/documentation/platform/access-controls/access-requests), [temporary access provisioning](/documentation/platform/access-controls/temporary-access), and more.
- **Improved security posture** thanks to [secret scanning](/cli/scanning-overview), [granular access control policies](/documentation/platform/access-controls/overview), [automated secret rotation](http://localhost:3000/documentation/platform/secret-rotation/overview), and [dynamic secrets](/documentation/platform/dynamic-secrets/overview) capabilities.
## How does Infisical work?
To make secret management effortless and secure, Infisical follows a certain structure for enabling secret management workflows as defined below.
**Identities** in Infisical are users or machine which have a certain set of roles and permissions assigned to them. Such identities are able to manage secrets in various **Clients** throughout the entire infrastructure. To do that, identities have to verify themselves through one of the available **Authentication Methods**.
As a result, the 3 main concepts that are important to understand are:
- **[Identities](/documentation/platform/identities/overview)**: users or machines with a set permissions assigned to them.
- **[Clients](/integrations/platforms/kubernetes)**: Infisical-developed tools for managing secrets in various infrastructure components (e.g., [Kubernetes Operator](/integrations/platforms/kubernetes), [Infisical Agent](/integrations/platforms/infisical-agent), [CLI](/cli/usage), [SDKs](/sdks/overview), [API](/api-reference/overview/introduction), [Web Dashboard](/documentation/platform/organization)).
- **[Authentication Methods](/documentation/platform/identities/universal-auth)**: ways for Identities to authenticate inside different clients (e.g., SAML SSO for Web Dashboard, Universal Auth for Infisical Agent, etc.).
## How to get started with Infisical?
Depending on your use case, it might be helpful to look into some of the resources and guides provided below.
<CardGroup cols={2}>
<Card href="../../cli/overview" title="Command Line Interface (CLI)" icon="square-terminal" color="#000000">
Inject secrets into any application process/environment.
</Card>
<Card
title="SDKs"
href="/documentation/getting-started/sdks"
icon="boxes-stacked"
color="#3c8639"
color="#000000"
>
Fetch secrets with any programming language on demand
Fetch secrets with any programming language on demand.
</Card>
<Card href="../../integrations/platforms/docker-intro" title="Docker" icon="docker" color="#0078d3">
Inject secrets into Docker containers
<Card href="../../integrations/platforms/docker-intro" title="Docker" icon="docker" color="#000000">
Inject secrets into Docker containers.
</Card>
<Card
href="../../integrations/platforms/kubernetes"
title="Kubernetes"
icon="server"
color="#3775a9"
color="#000000"
>
Fetch and save secrets as native Kubernetes secrets
Fetch and save secrets as native Kubernetes secrets.
</Card>
<Card
href="/documentation/getting-started/api"
title="REST API"
icon="cloud"
color="#3775a9"
color="#000000"
>
Fetch secrets via HTTP request
</Card>
</CardGroup>
## Resources
<CardGroup cols={2}>
<Card
href="/self-hosting/overview"
title="Self-hosting"
icon="server"
color="#0285c7"
>
Learn how to configure and deploy Infisical
</Card>
<Card
href="/documentation/guides/introduction"
title="Guide"
icon="book-open"
color="#dc2626"
>
Explore guides for every language and stack
Fetch secrets via HTTP request.
</Card>
<Card
href="/integrations/overview"
title="Native Integrations"
icon="clouds"
color="#dc2626"
color="#000000"
>
Explore integrations for GitHub, Vercel, Netlify, and more
</Card>
<Card
href="/integrations/overview"
title="Frameworks"
icon="plug"
color="#dc2626"
>
Explore integrations for Next.js, Express, Django, and more
</Card>
<Card
href="/cli/scanning-overview"
title="Secret scanning"
icon="satellite-dish"
color="#0285c7"
>
Scan and prevent 140+ secret type leaks in your codebase
Explore integrations for GitHub, Vercel, AWS, and more.
</Card>
</CardGroup>

2
docs/documentation/getting-started/platform.mdx
View File

@@ -21,7 +21,7 @@ Here, you can also create a new project.
The **Members** page lets you add or remove external members to your organization.
Note that you can configure your organization in Infisical to have members authenticate with the platform via protocols like SAML 2.0.
![organization members](../../images/organization-members.png)
![organization members](../../images/organization/platform/organization-members.png)
## Managing your Projects

34
docs/documentation/guides/local-development.mdx Normal file
View File

@@ -0,0 +1,34 @@
---
title: "Secret Management in Development Environments"
sidebarTitle: "Local Development"
description: "Learn how to manage secrets in local development environments."
---
## Problem at hand
There is a number of issues that arise with secret management in local development environment:
1. **Getting secrets onto local machines**. When new developers join or a new project is created, the process of getting the development set of secrets onto local machines is often unclear. As a result, developers end up spending a lot of time onboarding and risk potentially following insecure practices when sharing secrets from one developer to another.
2. **Syncing secrets with teammates**. One of the problems with .env files is that they become unsynced when one of the developers updates a secret or configuration. Even if the rest of the team is notified, developers don't make all the right changes immediately, and later on end up spending a lot of time debugging an issue due to missing environment variables. This leads to a lot of inefficiencies and lost time.
3. **Accidentally leaking secrets**. When developing locally, it's common for developers to accidentally leak a hardcoded as part of a commit. As soon as the secret is part of the git history, it becomes hard to get it removed and create a security vulnerability.
## Solution
One of the main benefits of Infisical is the facilitation of secret management workflows in local development use cases. In particular, Infisical heavily follows the "Security Shift Left" principle to enable developers to effotlessly follow secure practices when coding.
### CLI
[Infisical CLI](/cli/overview) is the most frequently used Infisical tool for secret management in local development environments. It makes it easy to inject secrets right into the local application environments based on the permissions given to corresponsing developers.
### Dashboard
On top of that, Infisical provides a great [Web Dashboard](https://app.infisical.com/signup) that can be used to making quick secret updates.
![project dashboard](../../images/dashboard.png)
### Personal Overrides
By default, all the secrets in the Infisical environments are shared among project members who have the permission to access those environment. At the same time, when doing local development, it is often desirable to change the value of a certain secret only for a particular self. For such use cases, Infisical supports the functionality of **Personal Overrides** – which allow developers to override values of any secrets without affecting the workflows of the rest of the team. Personal Overrides can be created both in the dashboard or via [Infisical CLI](/cli/overview).
### Secret Scanning
In addition, Infisical also provides a set of tools to automatically prevent secret leaks to git history. This functionlality can be set up on the level of [Infisical CLI using pre-commit hooks](/cli/scanning-overview#automatically-scan-changes-before-you-commit) or through a direct integration with platforms like GitHub.

13
docs/documentation/platform/access-controls/access-requests.mdx Normal file
View File

@@ -0,0 +1,13 @@
---
title: "Access Requests"
description: "Learn how to request access to sensitive resources in Infisical."
---
In certain situations, developers need to expand their access to certain new project or a sensitive environment. For those use cases, it is helpful to utilize Infisical's **Access Requests** functionality.
This functionality works in the following way:
1. A project administrator sets up a policy that assigns access managers to a certain sensitive folder or environment.
2. When a developer requests access to one of such sensitive resources, corresponding access managers get an email notification about it.
3. An access manager can approve or deny the access request as well as specify the duration of access in the case of approval.
4. As soon as the request is approved, developer is able to access the sought resources.

22
docs/documentation/platform/access-controls/additional-privileges.mdx Normal file
View File

@@ -0,0 +1,22 @@
---
title: "Additional Privileges"
description: "Learn how to add specific privileges on top of predefined roles."
---
Even though Infisical supports full-fledged [role-base access controls](./role-based-access-controls) with ability to set predefined permissions for user and machine identities, it is sometimes desired to set additional privileges for specific user or machine identities on top of their roles.
Infisical **Additional Privileges** functionality enables specific permissions with access to sensitive secrets/folders by identities within certain projects. It is possible to set up additional privileges through Web UI or API.
To provision specific privileges through Web UI:
1. Click on the `Edit` button next to the set of roles for user or identities.
![Edit User Role](../../images/platform/access-controls/edit-role.png)
2. Click `Add Additional Privileges` in the corresponding section of the permission management modal.
![Add Specific Privilege](../../images/platform/access-controls/add-additional-privileges.png)
3. Fill out the necessary parameters in the privilege entry that appears. It is possible to specify the `Environment` and `Secret Path` to which you want to enable access.
It is also possible to define the range of permissions (`View`, `Create`, `Modify`, `Delete`) as well as how long the access should last (e.g., permanent or timed).
![Additional privileges](../../images/platform/access-controls/additional-privileges.png)
4. Click the `Save` button to enable the additional privilege.
![Confirm Specific Privilege](../../images/platform/access-controls/confirm-additional-privileges.png)

58
docs/documentation/platform/access-controls/overview.mdx Normal file
View File

@@ -0,0 +1,58 @@
---
title: "Access Controls"
sidebarTitle: "Overview"
description: "Learn about Infisical's access control toolset."
---
To make sure that users and machine identities are only accessing the resources and performing actions they are authorized to, Infisical supports a wide range of access control tools.
<CardGroup cols={2}>
<Card
title="Role-based Access Controls"
href="./role-based-access-controls"
icon="address-book"
color="#000000"
>
Manage user and machine identitity permissions through predefined roles.
</Card>
<Card
title="Additional Privileges"
href="./additional-privileges"
icon="ballot-check"
color="#000000"
>
Add specific privileges to users and machines on top of their roles.
</Card>
<Card
title="Temporary Access"
href="./temporary-access"
icon="clock"
color="#000000"
>
Grant timed access to roles and specific privileges.
</Card>
<Card
title="Access Requests"
href="./access-requests"
icon="check"
color="#000000"
>
Enable users to request (temporary) access to sensitive resources.
</Card>
<Card
title="Approval Workflows"
href="/documentation/platform/pr-workflows"
icon="thumbs-up"
color="#000000"
>
Set up review policies for secret changes in sensitive environments.
</Card>
<Card
title="Audit Logs"
href="/documentation/platform/audit-logs"
icon="list"
color="#000000"
>
Track every action performed by user and machine identities in Infisical.
</Card>
</CardGroup>

44
docs/documentation/platform/access-controls/role-based-access-controls.mdx Normal file
View File

@@ -0,0 +1,44 @@
---
title: "Role-based Access Controls"
description: "Learn how to use RBAC to manage user permissions."
---
Infisical's Role-based Access Controls (RBAC) enable the usage of predefined and custom roles that imply a set of permissions for user and machine identities. Such roles male it possible to restrict access to resources and the range of actions that can be performed.
In general, access controls can be split up across [projects](/documentation/platform/project) and [organizations](/documentation/platform/organization).
## Organization-level access controls
By default, every user and machine identity in a organization is either an **admin** or a **member**.
**Admins** are able to perform every action with the organization, including adding and removing organization members, managing access controls, setting up security settings, and creating new projects.
**Members**, on the other hand, are restricted from removing organization members, modifying billing information, updating access controls, and performing a number of other actions.
Overall, organization-level access controls are significantly of administrative nature. Access to projects, secrets and other sensitive data is specified on the project level.
![Org member role](../../images/platform/rbac/org-member-role.png)
## Project-level access controls
By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles comes with a varying access to different features and resources inside projects.
As such:
- **Admin**: This role enables identities to have access to all environments, folders, secrets, and actions within the project.
- **Developers**: This role restricts identities from performing project control actions, updating Approval Workflow policies, managing roles/members, and more.
- **Viewer**: The most limiting bulit-in role on the project level – it forbids user and machine identities to perform any action and rather shows them in the read-only mode.
![Project member role](../../images/platform/access-controls/rbac.png)
## Creating custom roles
By creating custom roles, you are able to adjust permissions to the needs of your organization. This can be useful for:
- Creating superadmin roles, roles specific to SRE engineers, etc.
- Restricting access of users to specific secrets, folders, and environments.
- Embedding these specific roles into [Approval Workflow policies](/documentation/platform/pr-workflows).
<Note>
It is worth noting that users are able to assume multiple built-in and custom roles. A user will gain access to all actions within the roles assigned to them, not just the actions those roles share in common.
</Note>
![project member custom role](../../images/platform/rbac/project-member-custom-role.png)

26
docs/documentation/platform/access-controls/temporary-access.mdx Normal file
View File

@@ -0,0 +1,26 @@
---
title: "Temporary Access"
description: "Learn how to set up timed access to sensitive resources for user and machine identities."
---
Certain environments and secrets are so sensitive that it is recommended to not give any user permanent access to those. For such use cases, Infisical supports the functionality of **Temporary Access** provisioning.
To provision temporary access through Web UI:
1. Click on the `Edit` button next to the set of roles for user or identities.
![Edit User Role](../../images/platform/access-controls/edit-role.png)
2. Click `Permanent` next to the role or specific privilege that you want to make temporary.
3. Specify the duration of remporary access (e.g., `1m`, `2h`, `3d`).
![Configure temp access](../../images/platform/access-controls/configure-temporary-access.png)
4. Click `Grant`.
5. Click the corresponding `Save` button to enable remporary access.
![Temporary Access](../../images/platform/access-controls/temporary-access.png)
<Note>
Every user and machine identity should always have at least one permanent role attached to it.
</Note>

23
docs/documentation/platform/audit-logs.mdx
View File

@@ -1,27 +1,28 @@
---
title: "Audit Logs"
description: "See which events are triggered within your Infisical project."
description: "Track evert event action performed within Infisical projects."
---
<Info>
Note that Audit Logs is a paid feature.
If you're using Infisical Cloud, then it is available under the **Team Tier**, **Pro Tier**,
If you're using Infisical Cloud, then it is available under the **Pro**,
and **Enterprise Tier** with varying retention periods. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
Infisical provides audit logs for security and compliance teams to monitor information access.
With this feature, teams can track 25+ different events;
filter audit logs by event, actor, source, date or any combination of these filters;
and inspect extensive metadata in the event of any suspicious activity or incident review.
With the Audit Log functionality, teams can:
- **Track** 40+ different events;
- **Filter** audit logs by event, actor, source, date or any combination of these filters;
- **Inspect** extensive metadata in the event of any suspicious activity or incident review.
![Audit logs](../../images/platform/audit-logs/audit-logs-table.png)
Each log contains the following data:
- Event: The underlying action such as create, list, read, update, or delete secret(s).
- Actor: The entity responsible for performing or causing the event; this can be a user or service.
- Timestamp: The date and time at which point the event occurred.
- Source (User agent + IP): The software (user agent) and network address (IP) from which the event was initiated.
- Metadata: Additional data to provide context for each event. For example, this could be the path at which a secret was fetched from etc.
- **Event**: The underlying action such as create, list, read, update, or delete secret(s).
- **Actor**: The entity responsible for performing or causing the event; this can be a user or service.
- **Timestamp**: The date and time at which point the event occurred.
- **Source** (User agent + IP): The software (user agent) and network address (IP) from which the event was initiated.
- **Metadata**: Additional data to provide context for each event. For example, this could be the path at which a secret was fetched from etc.

14
docs/documentation/platform/auth-methods/email-password.mdx Normal file
View File

@@ -0,0 +1,14 @@
---
title: "Email and Pasword"
description: "Learn how to authenticate into Infisical with email and password."
---
**Email and Password** is the most common authentication method that can be used by user identities for authentication into Web Dashboard and Infisical CLI. It is recommended to utilize [Multi-factor Authentication](/documentation/platform/mfa) in addition to it.
It is currently possible to use the **Email and Password** auth method to authenticate into the Web Dashboard and Infisical CLI.
Every **Email and Password** is accompanied by an emergency kit given to users during signup. If the password is lost or forgotten, emergency kit is only way to retrieve the access to your account. It is possible to generate a new emergency kit with the following steps:
1. Open the `Personal Settings` menu.
![open personal settings](../../images/auth-methods/access-personal-settings.png)
2. Scroll down to the `Emergency Kit` section.
3. Enter your current password and click `Save`.

13
docs/documentation/platform/folder.mdx
View File

@@ -1,11 +1,12 @@
---
title: "Folders"
description: "Organize your secrets with folders"
description: "Learn how to organize secrets with folders."
---
Infisical's folder feature lets you store secrets at a specific folder; we also call this **path-based secret storage**.
This is great for organizing secrets around hierarchies when multiple services, types of secrets, etc. are involved at great quantities.
With folders that can go infinitely deep, you can mirror your application architecture (be it microservices or monorepos)
Infisical Folders enable users to organize secrets using custom structures dependent on the intended use case (also known as **path-based secret storage**).
It is great for organizing secrets around hierarchies with multiple services or types of secrets involved at large quantities.
Infisical Folders can be infinitely nested to mirror your application architecture – whether it's microservices, monorepos,
or any logical grouping that best suits your needs.
Consider the following structure for a microservice architecture:
@@ -25,9 +26,7 @@ In this example, we store environment variables for each microservice under each
We also store user-specific secrets for micro-service 1 under `/service1/users`. With this folder structure in place, your applications only need to specify a path like `/microservice1/envars` to fetch secrets from there.
By extending this example, you can see how path-based secret storage provides a versatile approach to manage secrets for any architecture.
## Folders
### Managing folders
## Managing folders
To add a folder, press the downward chevron to the right of the **Add Secret** button; then press on the **Add Folder** button.

59
docs/documentation/platform/identities/machine-identities.mdx Normal file
View File

@@ -0,0 +1,59 @@
---
title: Machine Identities
description: "Learn how to use Machine Identities to programmatically interact with Infisical."
---
## Concept
An Infisical machine identity is an entity that represents a workload or application that require access to various resources in Infisical. This is conceptually similar to an IAM user in AWS or service account in Google Cloud Platform (GCP).
Each identity must authenticate with the API using a supported authentication method like [Universal Auth](/documentation/platform/identities/universal-auth) to get back a short-lived access token to be used in subsequent requests.
![organization identities](../../images/platform/organization/organization-machine-identities.png)
Key Features:
- Role Assignment: Identities must be assigned [roles](/documentation/platform/role-based-access-controls). These roles determine the scope of access to resources, either at the organization level or project level.
- Auth/Token Configuration: Identities must be configured with corresponding authentication methods and access token properties to securely interact with the Infisical API.
## Workflow
A typical workflow for using identities consists of four steps:
1. Creating the identity with a name and [role](/documentation/platform/role-based-access-controls) in Organization Access Control > Machine Identities.
This step also involves configuring an authentication method for it such as [Universal Auth](/documentation/platform/identities/universal-auth).
2. Adding the identity to the project(s) you want it to have access to.
3. Authenticating the identity with the Infisical API based on the configured authentication method on it and receiving a short-lived access token back.
4. Authenticating subsequent requests with the Infisical API using the short-lived access token.
<Note>
Currently, identities can only be used to make authenticated requests to the Infisical API, SDKs, Terraform, Kubernetes Operator, and Infisical Agent. They do not work with clients such as CLI, Ansible look up plugin, etc.
Machine Identity support for the rest of the clients is planned to be released in the current quarter.
</Note>
## Authentication Methods
To interact with various resources in Infisical, Machine Identities are able to authenticate using:
- [Universal Auth](/documentation/platform/identities/universal-auth): the most versatile authentication method that can be configured on an identity from any platform/environment to access Infisical.
## FAQ
<AccordionGroup>
<Accordion title="What is the difference between an identity and service token?">
A service token is a project-level authentication method that is being phased out in favor of identities.
Amongst many differences, identities provide broader access over the Infisical API, utilizes the same
permission system as user identities, and come with a significantly larger number of configurable authentication and security features.
</Accordion>
<Accordion title="Why can I not create, read, update, or delete an identity?">
There are a few reasons for why this might happen:
- You have insufficient organization permissions to create, read, update, delete identities.
- The identity you are trying to read, update, or delete is more privileged than yourself.
- The role you are trying to create an identity for or update an identity to is more privileged than yours.
</Accordion>
</AccordionGroup>

69
docs/documentation/platform/identities/overview.mdx
View File

@@ -1,53 +1,26 @@
---
title: Identities
description: "Programmatically interact with Infisical"
title: "User and Machine Identities"
sidebarTitle: "Overview"
description: "Learn more about identities to interact with resources in Infisical."
---
<Note>
Currently, identities can only be used to make authenticated requests to the Infisical API, SDKs, Terraform, K8s Operator, and Agent. They do not work with clients such as CLI, Ansible look up plugin, etc.
To interact with secrets and resource with Infisical, it is important to undrestand the concept of identities.
Identities can be of two types:
- **People** (e.g., developers, platform engineers, administrators)
- **Machines** (e.g., machine entities for managing secrets in CI/CD pipelines, production applications, and more)
We will be releasing compatibility with it across clients in the coming quarter.
</Note>
Both people and machines are able to utilize corresponding clients (e.g., Dashboard UI, CLI, SDKs, API, Kubernetes Operator) together with allowed authentication methods (e.g., email & password, SAML SSO, LDAP, OIDC, Universal Auth).
## Concept
A (machine) identity is an entity that you can create in an Infisical organization to represent a workload or application that requires access to the Infisical API. This is conceptually similar to an IAM user in AWS or service account in Google Cloud Platform (GCP).
Each identity must authenticate with the API using a supported authentication method like [Universal Auth](/documentation/platform/identities/universal-auth) to get back a short-lived access token to be used in subsequent requests.
Key Features:
- Role Assignment: Identities must be assigned [roles](/documentation/platform/role-based-access-controls). These roles determine the scope of access to resources, either at the organization level or project level.
- Auth/Token Configuration: Identities must be configured with auth methods and access token properties to securely interact with the Infisical API.
## Workflow
A typical workflow for using identities consists of four steps:
1. Creating the identity with a name and [role](/documentation/platform/role-based-access-controls) in Organization Access Control > Machine Identities.
This step also involves configuring an authentication method for it such as [Universal Auth](/documentation/platform/identities/universal-auth).
2. Adding the identity to the project(s) you want it to have access to.
3. Authenticating the identity with the Infisical API based on the configured authentication method on it and receiving a short-lived access token back.
4. Authenticating subsequent requests with the Infisical API using the short-lived access token.
Check out the following authentication method-specific guides for step-by-step instruction on how to use identities to access Infisical:
- [Universal Auth](/documentation/platform/identities/universal-auth)
**FAQ**
<AccordionGroup>
<Accordion title="What is the difference between an identity and service token?">
A service token is a project-level authentication method that is being phased out in favor of identities.
Amongst many differences, identities provide broader access over the Infisical API, utilizes the same role-based
permission system used by users, and comes with ample more configurable authentication and security features.
</Accordion>
<Accordion title="Why can I not create, read, update, or delete an identity?">
There are a few reasons for why this might happen:
- You have insufficient organization permissions to create, read, update, delete identities.
- The identity you are trying to read, update, or delete is more privileged than yourself.
- The role you are trying to create an identity for or update an identity to is more privileged than yours.
</Accordion>
</AccordionGroup>
<CardGroup cols={2}>
<Card href="./user-identities" title="People (User Identities)" icon="people" color="#000000">
Learn more about the concept on user identities in Infisical.
</Card>
<Card
title="Machine Identities"
href="./machine-identities"
icon="computer"
color="#000000"
>
Understand the concept of machine identities in Infisical.
</Card>
</CardGroup>

6
docs/documentation/platform/identities/universal-auth.mdx
View File

@@ -1,9 +1,9 @@
---
title: Universal Auth
description: "Authenticate with Infisical from any platform/environment"
description: "Learn how to authenticate to Infisical from any platform or environment."
---
**Universal Auth** is the most versatile authentication method that can be configured on an identity from any platform/environment to access Infisical.
**Universal Auth** is the most versatile authentication method that can be configured for a [machine identity](/documentation/platform/identities/machine-identities) to access Infisical from any platform or environment.
In this method, each identity is given a **Client ID** for which you can generate one or more **Client Secret(s)**. Together, a **Client ID** and **Client Secret** can be exchanged for an access token to authenticate with the Infisical API.
@@ -50,7 +50,7 @@ using the Universal Auth authentication method.
<Warning>
Restricting **Client Secret** and access token usage to specific trusted IPs is a paid feature.
If you’re using Infisical Cloud, then it is available under the Pro Tier. If you’re self-hosting Infisical, then you should contact team@infisical.com to purchase an enterprise license to use it.
If you’re using Infisical Cloud, then it is available under the Pro Tier. If you’re self-hosting Infisical, then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Warning>
</Step>

23
docs/documentation/platform/identities/user-identities.mdx Normal file
View File

@@ -0,0 +1,23 @@
---
title: User Identities
description: "Read more about the concept of user identities in Infisical."
---
## Concept
A **user identity** (also known as **user**) represents a developer, admin, or any other human entity interacting with resources in Infisical.
Users can be added manually (through Web UI) or programmatically (e.g., API) to [organizations](../organization) and [projects](../projects).
Upon being added to an organizaztion and projects, users assume a certain set of roles and permissions that represents their identity.
![organization members](../../images/platform/organization/organization-members.png)
## Authentication methods
To interact with various resources in Infisical, users are able to utilize a number of authentication methods:
- **Email & Password**: the most common authentication method that is used for authentication into Web Dashboard and Infisical CLI. It is recommended to utilize [Multi-factor Authentication](/documentation/platform/mfa) in addition to it.
- **Service Tokens**: Service tokens allow users authenticate into CLI and other clients under their own identity. For the majority of use cases, it is not a recommended approach. Instead, it is often a good idea to utilize [Machine Identities](./machine-identities) with [Universal Authentication](/documentation/platform/identities/universal-auth).
- **SSO**: Infisical natively integrates with a number of SSO identity providers like [Google](/documentation/platform/sso/google), [GitHub](/documentation/platform/sso/github), and [GitLab](/documentation/platform/sso/gitlab).
- **SAML SSO**: It is also possible to set up SAML SSO integration with identity providers like [Okta](/documentation/platform/sso/okta), [Microsoft Entra ID](/documentation/platform/sso/azure) (formerly known as Azure AD), [JumpCloud](/documentation/platform/sso/jumpcloud), [Google](/documentation/platform/sso/google-saml), and more.
- **LDAP**: For organizations with more advanced needs, Infisical also provides user authentication with [LDAP](/documentation/platform/ldap/overview) that includes a number of LDAP providers.

2
docs/documentation/platform/ip-allowlisting.mdx
View File

@@ -14,7 +14,7 @@ description: "Restrict access to your secrets in Infisical using trusted IPs"
Note that IP Allowlisting is a paid feature.
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
Projects in Infisical can be configured to restrict client access to specific IP addresses or CIDR ranges. This applies to any client using service tokens and

2
docs/documentation/platform/ldap.mdx
View File

@@ -7,7 +7,7 @@ description: "Log in to Infisical with LDAP"
LDAP is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol).

4
docs/documentation/platform/ldap/general.mdx
View File

@@ -1,12 +1,12 @@
---
title: "General LDAP"
description: "Log in to Infisical with LDAP"
description: "Learn how to log in to Infisical with LDAP."
---
<Info>
LDAP is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)

4
docs/documentation/platform/ldap/jumpcloud.mdx
View File

@@ -1,12 +1,12 @@
---
title: "JumpCloud LDAP"
description: "Configure JumpCloud LDAP for Logging into Infisical"
description: "Learn how to configure JumpCloud LDAP for authenticating into Infisical."
---
<Info>
LDAP is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
<Steps>

12
docs/documentation/platform/ldap/overview.mdx
View File

@@ -1,6 +1,7 @@
---
title: "LDAP Overview"
description: "Log in to Infisical with LDAP"
sidebarTitle: "Overview"
description: "Learn how to authenticate into Infisical with LDAP."
---
<Info>
LDAP is a paid feature.
@@ -9,9 +10,9 @@ description: "Log in to Infisical with LDAP"
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)
You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol).
To note, configuring LDAP retains the end-to-end encrypted architecture of Infisical because we decouple the authentication and decryption steps; the LDAP server cannot and will not have access to the decryption key needed to decrypt your secrets.
To note, configuring LDAP retains the end-to-end encrypted nature of authentication in Infisical because we decouple the authentication and decryption steps; the LDAP server cannot and will not have access to the decryption key needed to decrypt your secrets.
LDAP providers:
@@ -20,4 +21,7 @@ LDAP providers:
- AWS Directory Service
- Foxpass
Check out the general instructions for configuring LDAP [here](/documentation/platform/ldap/general).
Read the general instructions for configuring LDAP [here](/documentation/platform/ldap/general).
If the documentation for your required identity provider is not shown in the list above, please reach out to [team@infisical.com](mailto:team@infisical.com) for assistance.

5
docs/documentation/platform/mfa.mdx
View File

@@ -1,6 +1,7 @@
---
title: "MFA"
description: "Secure your Infisical account with MFA"
title: "Multi-factor Authentication"
sidebarTitle: "MFA"
description: "Learn how to secure your Infisical account with MFA."
---
MFA requires users to provide multiple forms of identification to access their account. Currently, this means logging in with your password and a 6-digit code sent to your email.

30
docs/documentation/platform/organization.mdx
View File

@@ -1,9 +1,9 @@
---
title: "Organization"
description: "How Infisical structures its organizations."
title: "Organizations"
description: "Learn more and understand the concept of Infisical organizations."
---
An organization houses projects and members.
An Infisical organization is a set of [projects](./project) that use the same billing. Organizations allow one or more users to control billing and project permissions for all of the projects belonging to the organization. Each project belongs to an organization.
## Projects
@@ -18,21 +18,23 @@ The **Settings** page lets you manage information about your organization includ
- Name: The name of your organization.
- Incident contacts: Emails that should be alerted if anything abnormal is detected within the organization.
- SAML Authentication: The SAML SSO configuration of the organization (if applicable); Infisical currently
supports Okta, Azure, and JumpCloud identity providers.
![organization settings general](../../images/platform/organization/organization-settings-general.png)
- Security and Authentication: A set of setting to enforce or manage [SAML](/documentation/platform/sso/overview), [SCIM](/documentation/platform/scim/overview), [LDAP](/documentation/platform/ldap/overview), and other authentication configurations.
![organization settings auth](../../images/platform/organization/organization-settings-auth.png)
## Members
## Access Control
The **Members** page is where you can manage members and their permissions within the organization.
In the **Members** tab, you can add external members to your organization or remove them; you can also
change their role.
The **Access Control** page is where you can manage identities (both people and machines) that are part of your organization.
You can add or remove additional members as well as modify their permissions.
![organization members](../../images/organization-members.png)
![organization members](../../images/platform/organization/organization-members.png)
![organization identities](../../images/platform/organization/organization-machine-identities.png)
In the **Roles** tab, you can manage roles for members within the organization.
In the **Organization Roles** tab, you can edit current or create new custom roles for members within the organization.
<Info>
Note that Role-Based Access Management (RBAC) is partly a paid feature.
@@ -41,13 +43,13 @@ In the **Roles** tab, you can manage roles for members within the organization.
at the organization and project level for free.
If you're using Infisical Cloud, the ability to create custom roles is available under the **Pro Tier**.
If you're self-hosting Infisical, then you should contact team@infisical.com to purchase an enterprise license to use it.
If you're self-hosting Infisical, then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
![organization roles](../../images/platform/organization/organization-members-roles.png)
As you can see next, Infisical supports granular permissions that you can tailor to each role. So,
if you need certain members to only be able to access billing details, for example, then you can
As you can see next, Infisical supports granular permissions that you can tailor to each role.
If you need certain members to only be able to access billing details, for example, then you can
assign them that permission only.
![organization role permissions](../../images/platform/organization/organization-members-roles-add-perm.png)

18
docs/documentation/platform/pit-recovery.mdx
View File

@@ -1,21 +1,21 @@
---
title: "Point-in-Time Recovery"
description: "How to rollback secrets and configs to any commit with Infisical."
description: "Learn how to rollback secrets and configurations to any snapshot with Infisical."
---
<Info>
Point-in-Time Recovery is a paid feature.
If you're using Infisical Cloud, then it is available under the **Team Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
Infisical's point-in-time recovery feature allows secrets to be rolled back to any point in time for any given [folder](./folder).
Under the hood, snapshots, capturing the state of the folder, get taken after any mutation an item within that folder.
Infisical's point-in-time recovery functionality allows secrets to be rolled back to any point in time for any given [folder](./folder) or [environment](/documentation/platform/project#project-environments).
Every time a secret is updated, a new snapshot is taken – capturing the state of the folder and environment at that point of time.
## Snapshots
Similar to Git, a commit (aka snapshot) in Infisical is the state of your project's secrets at a specific point in time scoped to
Similar to Git, a commit (also known as snapshot) in Infisical is the state of your project's secrets at a specific point in time scoped to
an environment and [folder](./folder) within it.
To view a list of snapshots for the current folder, press the **Commits** button.
@@ -28,12 +28,14 @@ This opens up a sidebar from which you can select to view a particular snapshot:
## Rolling back
After pressing on a snapshot from the sidebar, you can view it and even roll back the state
After pressing on a snapshot from the sidebar, you can view it and roll back the state
of the folder to that point in time by pressing the **Rollback** button.
![PIT snapshot](../../images/platform/pit-recovery/pit-recovery-rollback.png)
Rolling back secrets to a past snapshot creates a creates a snapshot at the top of the stack and updates secret versions.
Note that rollbacks are localized to not affect other folders within the same environment. This means each [folder](./folder) maintains its own independent history of changes, offering precise and isolated control over rollback actions.
<Note>
Rollbacks are localized to not affect other folders within the same environment. This means each [folder](./folder) maintains its own independent history of changes, offering precise and isolated control over rollback actions.
Put differently, every [folder](./folder) possesses a distinct and separate timeline, providing granular control when managing your secrets.
</Note>

10
docs/documentation/platform/pr-workflows.mdx
View File

@@ -1,6 +1,6 @@
---
title: "PR Workflows"
description: "Infisical PR Workflows allows you to create a set of policies to control secret operations."
title: "Approval Workflows"
description: "Learn how to enable a set of policies to manage changes to sensitive secrets and environments."
---
## Problem at hand
@@ -14,15 +14,15 @@ Updating secrets in high-stakes environments (e.g., production) can have a numbe
As a wide-spread software engineering practice, developers have to submit their code as a PR that needs to be approved before the code is merged into the main branch.
In a similar way, to solve the above-mentioned issues, Infisical provides a feature called `PR Workflows` for secret management. This is a set of policies and workflows that help advance access controls, compliance procedures, and stability of a particular environment. In other words, **PR Workflows** help you secure, stabilize, and streamline the change of secrets in high-stakes environments.
In a similar way, to solve the above-mentioned issues, Infisical provides a feature called `Approval Workflows` for secret management. This is a set of policies and workflows that help advance access controls, compliance procedures, and stability of a particular environment. In other words, **Approval Workflows** help you secure, stabilize, and streamline the change of secrets in high-stakes environments.
### Setting a policy
First, you would need to create a set of policies for a certain environment. In the example below you can see a generic policy for a production environment. In this case, any user who submits a change to `prod` would first have to get an approval by a predefined user (or multiple users).
First, you would need to create a set of policies for a certain environment. In the example below, a generic policy for a production environment is shown. In this case, any user who submits a change to `prod` would first have to get an approval by a predefined approver (or multiple approvers).
![create secret update policy](../../images/platform/pr-workflows/secret-update-policy.png)
### Example of updating secrets with PR workflows
### Example of updating secrets with Approval workflows
When a user submits a change to an enviropnment that is under a particular policy, a corresponsing change request will go to a predefined approver (or multiple approvers).

16
docs/documentation/platform/project.mdx
View File

@@ -1,13 +1,21 @@
---
title: "Project"
description: "How Infisical organizes secrets into projects."
title: "Projects"
description: "Learn more and understand the concept of Infisical projects."
---
A project houses application configuration and secrets for an application.
A project in Infisical belongs to an [organization](./organization) and contains a number of environments, folders, and secrets.
Only users and machine identities who belong to a project can access resources inside of it according to predefined permissions.
## Project environments
For both visual and organizational structure, Infisical allows splitting up secrets into environments (e.g., development, staging, production). In project settings, such environments can be
customized depending on the intended use case.
![project secrets overview](../../images/platform/project/project-environments.png)
## Secrets Overview
The **Secrets Overview** page captures a birds-eye-view of secrets and folders across environments like development, staging, or production.
The **Secrets Overview** page captures a birds-eye-view of secrets and [folders](./folder) across environments.
This is useful for comparing secrets, identifying if anything is missing, and making quick changes.
![project secrets overview](../../images/platform/project/project-secrets-overview-open.png)

31
docs/documentation/platform/role-based-access-controls.mdx
View File

@@ -1,31 +0,0 @@
---
title: "Role-based Access Controls"
description: "Infisical's Role-based Access Controls enable creating permissions for user and machine identities to restrict access to resources and the range of actions that can be performed."
---
### General access controls
Access Control Policies provide a highly granular declarative way to grant or forbid access to certain resources and operations in Infisical. In general, access controls can be split up across projects and organizations.
### Organization-level access controls
By default, every user in a organization is either an **admin** or a **member**.
Admins are able to perform every action with the organization, including adding and removing organization members, managing access controls, setting up security settings, and creating new projects. Members, on the other hand, are restricted from removing organization members, modifying billing information, updating access controls, and performing a number of other actions.
Overall, organization-level access controls are significantly of administrative nature. Access to projects, secrets and other sensitive data is specified on the project level.
![Org member role](../../images/platform/rbac/org-member-role.png)
### Project-level access controls
By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles comes with a varying access to different features and resources inside projects. As such, **admins** by default have access to all environments, folders, secrets, and actions within the project. At the same time, **developers** are restricted from performing project control actions, updating PR Workflow policies, managing roles/members, and more. Lastly, **viewer** is the most limiting default role on the project level – it forbids developers to perform any action and rather shows them in the read-only mode.
### Creating custom roles
By creating custom roles, you are able to adjust permissions to the needs of your organization. This can be useful for:
- Creating superadmin roles, roles specific to SRE engineers, etc.
- Restricting access of users to specific secrets, folders, and environments.
- Embedding these specific roles into [PR Workflow policies](https://infisical.com/docs/documentation/platform/pr-workflows)
![project member custom role](../../images/platform/rbac/project-member-custom-role.png)

4
docs/documentation/platform/scim/azure.mdx
View File

@@ -1,13 +1,13 @@
---
title: "Azure SCIM"
description: "Configure SCIM provisioning with Azure for Infisical"
description: "Learn how to configure SCIM provisioning with Azure for Infisical."
---
<Info>
Azure SCIM provisioning is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
Prerequisites:

4
docs/documentation/platform/scim/jumpcloud.mdx
View File

@@ -1,13 +1,13 @@
---
title: "JumpCloud SCIM"
description: "Configure SCIM provisioning with JumpCloud for Infisical"
description: "Learn how to configure SCIM provisioning with JumpCloud for Infisical."
---
<Info>
JumpCloud SCIM provisioning is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
Prerequisites:

4
docs/documentation/platform/scim/okta.mdx
View File

@@ -1,13 +1,13 @@
---
title: "Okta SCIM"
description: "Configure SCIM provisioning with Okta for Infisical"
description: "Learn how to configure SCIM provisioning with Okta for Infisical."
---
<Info>
Okta SCIM provisioning is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
Prerequisites:

4
docs/documentation/platform/scim/overview.mdx
View File

@@ -1,13 +1,13 @@
---
title: "SCIM Overview"
description: "Provision users for Infisical via SCIM"
description: "Learn how to provision users for Infisical via SCIM."
---
<Info>
SCIM provisioning is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
You can configure your organization in Infisical to have members be provisioned/deprovisioned using [SCIM](https://scim.cloud/#Implementations2) via providers like Okta, Azure, JumpCloud, etc.

9
docs/documentation/platform/secret-reference.mdx
View File

@@ -1,11 +1,12 @@
---
title: "Secret Referencing / Importing"
description: "How to use reference secrets in Infisical"
title: "Secret Referencing and Importing"
sidebarTitle: "Referencing and Importing"
description: "Learn the fundamentals of secret referencing and importing in Infisical."
---
## Secret Referencing
Infisical's secret referencing feature lets you reference the value of a "base" secret when defining the value of another secret.
Infisical's secret referencing functionality makes it possible to reference the value of a "base" secret when defining the value of another secret.
This means that updating the value of a base secret propagates directly to other secrets whose values depend on the base secret.
<Note>
@@ -43,7 +44,7 @@ Here are a few more helpful examples for how to reference secrets in different c
## Secret Imports
Infisical's secret imports feature lets you import the items of another environment or folder into the current folder context.
Infisical's Secret Imports functionality makes it possible to import the secrets from another environment or folder into the current folder context.
This can be useful if you have common secrets that need to be available across multiple environments/folders.
To add a secret import, press the downward chevron to the right of the **Add Secret** button; then press on the **Add Import** button.

2
docs/documentation/platform/secret-rotation/aws-iam.mdx
View File

@@ -1,6 +1,6 @@
---
title: "AWS IAM User"
description: "Rotated access key id and secret key of AWS IAM Users"
description: "Learn how to automatically rotate Access Key Id and Secret Key of AWS IAM Users."
---
Infisical's AWS IAM User secret rotation capability lets you update the **Access key** and **Secret access key** credentials of a target IAM user from within Infisical

2
docs/documentation/platform/secret-rotation/mysql.mdx
View File

@@ -1,6 +1,6 @@
---
title: "MySQL/MariaDB"
description: "How to rotate MySQL/MariaDB database user passwords"
description: "Learn how to automatically rotate MySQL/MariaDB user passwords."
---
The Infisical MySQL secret rotation allows you to automatically rotate your MySQL database user's password at a predefined interval.

11
docs/documentation/platform/secret-rotation/overview.mdx
View File

@@ -1,4 +1,8 @@
# Secret Rotation Overview
---
title: "Secret Rotation"
sidebarTitle: "Overview"
description: "Learn how to set up automated secret rotation in Infisical."
---
## Introduction
@@ -7,8 +11,8 @@ Rotating secrets helps prevent unauthorized access to systems and sensitive data
Rotated secrets may include, but are not limited to:
1. API keys for external services
2. Database credentials for various platforms
1. API keys for external services;
2. Database credentials for various platforms.
## Rotation Process
@@ -42,3 +46,4 @@ Finally, the system promotes the future active (pending) secret to be the new cu
1. [SendGrid Integration](./sendgrid)
2. [PostgreSQL/CockroachDB Implementation](./postgres)
3. [MySQL/MariaDB Configuration](./mysql)
4. [AWS IAM User](./aws-iam)

2
docs/documentation/platform/secret-rotation/postgres.mdx
View File

@@ -1,6 +1,6 @@
---
title: "PostgreSQL/CockroachDB"
description: "How to rotate postgreSQL/cockroach database user passwords"
description: "Learn how to automatically rotate PostgreSQL/CockroachDB user passwords."
---
The Infisical Postgres secret rotation allows you to automatically rotate your Postgres database user's password at a predefined interval.

4
docs/documentation/platform/secret-rotation/sendgrid.mdx
View File

@@ -1,6 +1,6 @@
---
title: "Twilio SendGrid"
description: "How to rotate Twilio SendGrid API keys"
description: "Find out how to rotate Twilio SendGrid API keys."
---
Eliminate the use of long lived secrets by rotating Twilio SendGrid API keys with Infisical.
@@ -9,7 +9,7 @@ Eliminate the use of long lived secrets by rotating Twilio SendGrid API keys wit
You will need a valid SendGrid admin key with the necessary scope to create additional API keys.
Follow the [SendGrid Docs to create an admin api key](https://docs.sendgrid.com/ui/account-and-settings/api-keys)
Follow the [SendGrid Docs to create an admin api key](https://docs.sendgrid.com/ui/account-and-settings/api-keys).
## How it works

13
docs/documentation/platform/secret-versioning.mdx
View File

@@ -1,15 +1,20 @@
---
title: "Secret Versioning"
description: "Version secrets and configurations with Infisical"
description: "Learn how secret versioning works in Infisical."
---
Secret versioning records changes made to every secret.
Every time a secret change is persformed, a new version of the same secret is created.
![secret versioning](../../images/secret-versioning.png)
Such versions can be accessed visually by opening up the [secret sidebar](/documentation/platform/project#drawer) (as seen below) or [retrived via API](/api-reference/endpoints/secrets/read)
by specifying the `version` query parameter.
![secret versioning](../../images/platform/secret-versioning.png)
The secret versioning functionality is heavily connected to [Point-in-time Recovery](/documentation/platform/pit-recovery) of secrets in Infisical.
<Note>
You can copy and paste a secret version value to the "Value" input field "roll
back" to that secret version. This creates a new secret version at the top of
the stack. We're releasing the ability to press and automatically roll back to
the stack. We're releasing the ability to automatically roll back to
a secret version soon.
</Note>

6
docs/documentation/platform/sso/azure.mdx
View File

@@ -1,13 +1,13 @@
---
title: "Azure SAML"
description: "Configure Azure SAML for Infisical SSO"
title: "Entra ID / Azure AD SAML"
description: "Learn how to configure Microsoft Entra ID for Infisical SSO."
---
<Info>
Azure SAML SSO is a paid feature.
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
<Steps>

2
docs/documentation/platform/sso/github.mdx
View File

@@ -1,6 +1,6 @@
---
title: "GitHub SSO"
description: "Configure GitHub SSO for Infisical"
description: "Learn how to configure GitHub SSO for Infisical."
---
Using GitHub SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GitHub and registering your instance with it.

2
docs/documentation/platform/sso/gitlab.mdx
View File

@@ -1,6 +1,6 @@
---
title: "GitLab SSO"
description: "Configure GitLab SSO for Infisical"
description: "Learn how to configure GitLab SSO for Infisical."
---
Using GitLab SSO on a self-hosted instance of Infisical requires configuring an OAuth application in GitLab and registering your instance with it.

4
docs/documentation/platform/sso/google-saml.mdx
View File

@@ -1,13 +1,13 @@
---
title: "Google SAML"
description: "Configure Google SAML for Infisical SSO"
description: "Learn how to configure Google SAML for Infisical SSO."
---
<Info>
Google SAML SSO feature is a paid feature.
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
<Steps>

2
docs/documentation/platform/sso/google.mdx
View File

@@ -1,6 +1,6 @@
---
title: "Google SSO"
description: "Configure Google SSO for Infisical"
description: "Learn how to configure Google SSO for Infisical."
---
Using Google SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GCP and registering your instance with it.

4
docs/documentation/platform/sso/jumpcloud.mdx
View File

@@ -1,13 +1,13 @@
---
title: "JumpCloud SAML"
description: "Configure JumpCloud SAML for Infisical SSO"
description: "Learn how to configure JumpCloud SAML for Infisical SSO."
---
<Info>
JumpCloud SAML SSO is a paid feature.
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
<Steps>

4
docs/documentation/platform/sso/okta.mdx
View File

@@ -1,13 +1,13 @@
---
title: "Okta SAML"
description: "Configure Okta SAML 2.0 for Infisical SSO"
description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
---
<Info>
Okta SAML SSO is a paid feature.
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
<Steps>

13
docs/documentation/platform/sso/overview.mdx
View File

@@ -1,6 +1,7 @@
---
title: "SSO Overview"
description: "Log in to Infisical via SSO protocols"
sidebarTitle: "Overview"
description: "Learn how to log in to Infisical via SSO protocols."
---
<Info>
@@ -13,8 +14,12 @@ description: "Log in to Infisical via SSO protocols"
You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0).
To note, configuring SSO retains the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps. In all login with SSO implementations,
your IdP cannot and will not have access to the decryption key needed to decrypt your secrets.
To note, Infisical's SSO implementation decouples the **authentication** and **decryption** steps – which implies that no
Identitiy Provider can have access to the decryption key needed to decrypt your secrets (this also implies that Infisical requires entering the user's Master Password on top of authenticating with SSO).
## Identity providers
Infisical these and many other identity providers:
- [Google SSO](/documentation/platform/sso/google)
- [GitHub SSO](/documentation/platform/sso/github)
@@ -23,3 +28,5 @@ your IdP cannot and will not have access to the decryption key needed to decrypt
- [Azure SAML](/documentation/platform/sso/azure)
- [JumpCloud SAML](/documentation/platform/sso/jumpcloud)
- [Google SAML](/documentation/platform/sso/google-saml)
If your required identity provider is not shown in the list above, please reach out to [team@infisical.com](mailto:team@infisical.com) for assistance.

8
docs/documentation/platform/token.mdx
View File

@@ -1,6 +1,6 @@
---
title: "Service token"
description: "Infisical service tokens allows you to programmatically interact with Infisical"
title: "Service Token"
description: "Infisical service tokens allow users to programmatically interact with Infisical."
---
Service tokens are authentication credentials that services can use to access designated endpoints in the Infisical API to manage project resources like secrets.
@@ -43,6 +43,10 @@ Also, note that Infisical supports [glob patterns](https://www.malikbrowne.com/b
In the above screenshot, you can see that we are creating a token token with `read` access to all subfolders at any depth
of the `/common` path within the development environment of the project; the token expires in 6 months and can be used from any IP address.
<Note>
For a deeper understanding of service tokens, it is recommended to read [this guide](http://localhost:3000/internals/service-tokens).
</Note>
**FAQ**
<AccordionGroup>

2
docs/documentation/platform/webhooks.mdx
View File

@@ -1,6 +1,6 @@
---
title: "Webhooks"
description: "How Infisical webhooks works?"
description: "Learn the fundamentals of Infisical webhooks."
---
Webhooks can be used to trigger changes to your integrations when secrets are modified, providing smooth integration with other third-party applications.