No entries match these filters. Clear filters
Infisical adds MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.167.6 https://github.com/Infisical/infisical.git
$ git checkout v0.167.6
Add an MCP tool allowlist for MCP services in agent-vault, letting operators restrict which tools an MCP service may call. Add a grace period and restore capability for deleted secret manager projects, so accidental deletions can be recovered. Trust identity provider identity provider A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Link resource rows in secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. Add descriptions to agent-vault proxies.
+2 more
show less
Add a confirmation prompt before disabling or narrowing cross-project secret sharing to prevent accidental scope reductions. Support rotation on discovery import in PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
7 details in Everything
Infisical adds an OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.167.5 https://github.com/Infisical/infisical.git
$ git checkout v0.167.5
Infisical now acts as an OIDC issuer, letting other systems verify tokens against Infisical's identity. Agent Vault now exposes an MCP server, letting AI agents and MCP-compatible clients access vaulted credentials. Adds optional labels on Agent Vault sessions to identify and filter sessions by name. Adds a guided setup checklist and sample session to the Agent Vault UI to walk through first-time configuration. Adds delegated-approval policies so teams can define who may approve external access requests and implement an approval mechanism for those requests.
+5 more
show less
Secrets, folder, and import events now emit through the outbox for downstream consumption. Adds an audit-log improvement that normalizes free text in audit events for consistent querying. Adds an Insights view for unused secret access and secret read activity. Automatically revokes project access when a user loses their last path into an organisation. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
10 details in Everything
API surface changed: +10 endpoints, 39 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
API change API surface changed: +10 endpoints, 39 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
+ DELETE /api/v1/app-connections/jira/{connectionId} + GET /api/v1/app-connections/jira + GET /api/v1/app-connections/jira/available + GET /api/v1/app-connections/jira/connection-name/{connectionName} + GET /api/v1/app-connections/jira/{connectionId} + GET /api/v1/projects/{projectId}/memberships/available-users + PATCH /api/v1/agent-vault/sessions/{sessionId} + PATCH /api/v1/app-connections/jira/{connectionId} + POST /api/v1/app-connections/jira + POST /api/v1/app-connections/jira/{connectionId}/rotate-credentials
~ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: response schema changed ~ DELETE /api/v1/secret-syncs/cloudflare-pages/{syncId}: response schema changed ~ DELETE /api/v1/secret-syncs/cloudflare-workers/{syncId}: response schema changed ~ DELETE /api/v2/secret-rotations/stripe-api-key/{rotationId}: response schema changed ~ GET /api/v1/agent-vault/access-bundles/{accessBundleId}: response schema changed ~ GET /api/v1/agent-vault/sessions: response schema changed ~ GET /api/v1/agent-vault/sessions/{sessionId}: response schema changed ~ GET /api/v1/cert-manager/discovery-jobs: response schema changed ~ GET /api/v1/cert-manager/discovery-jobs/{discoveryId}: response schema changed ~ GET /api/v1/cert-manager/syncs/options: response schema changed ~ GET /api/v1/pki/syncs/options: response schema changed ~ GET /api/v1/secret-syncs/cloudflare-pages: response schema changed ~ GET /api/v1/secret-syncs/cloudflare-pages/sync-name/{syncName}: response schema changed ~ GET /api/v1/secret-syncs/cloudflare-pages/{syncId}: response schema changed ~ GET /api/v1/secret-syncs/cloudflare-workers: response schema changed ~ GET /api/v1/secret-syncs/cloudflare-workers/sync-name/{syncName}: response schema changed ~ GET /api/v1/secret-syncs/cloudflare-workers/{syncId}: response schema changed ~ GET /api/v2/secret-rotations/stripe-api-key: response schema changed ~ GET /api/v2/secret-rotations/stripe-api-key/rotation-name/{rotationName}: response schema changed ~ GET /api/v2/secret-rotations/stripe-api-key/{rotationId}: response schema changed ~ PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: request body changed; response schema changed ~ PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}/personal-values: request body changed ~ PATCH /api/v1/secret-syncs/cloudflare-pages/{syncId}: request body changed; response schema changed ~ PATCH /api/v1/secret-syncs/cloudflare-workers/{syncId}: request body changed; response schema changed ~ PATCH /api/v2/secret-rotations/stripe-api-key/{rotationId}: request body changed; response schema changed ~ POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services: request body changed; response schema changed ~ POST /api/v1/agent-vault/sessions: request body changed; response schema changed ~ POST /api/v1/agent-vault/sessions/{sessionId}/revoke: response schema changed ~ POST /api/v1/secret-syncs/cloudflare-pages: request body changed; response schema changed ~ POST /api/v1/secret-syncs/cloudflare-pages/{syncId}/import-secrets: response schema changed ~ POST /api/v1/secret-syncs/cloudflare-pages/{syncId}/remove-secrets: response schema changed ~ POST /api/v1/secret-syncs/cloudflare-pages/{syncId}/sync-secrets: response schema changed ~ POST /api/v1/secret-syncs/cloudflare-workers: request body changed; response schema changed ~ POST /api/v1/secret-syncs/cloudflare-workers/{syncId}/import-secrets: response schema changed ~ POST /api/v1/secret-syncs/cloudflare-workers/{syncId}/remove-secrets: response schema changed ~ POST /api/v1/secret-syncs/cloudflare-workers/{syncId}/sync-secrets: response schema changed ~ POST /api/v2/secret-rotations/stripe-api-key: request body changed; response schema changed ~ POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/move: response schema changed ~ POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/rotate-secrets: response schema changed
Adds new Jira app connection endpoints: DELETE /api/v1/app-connections/jira/{connectionId}, GET /api/v1/app-connections/jira, GET /api/v1/app-connections/jira/available, GET /api/v1/app-connections/jira/connection-name/{connectionName}, GET /api/v1/app-connections/jira/{connectionId}, PATCH /api/v1/app-connections/jira/{connectionId}, POST /api/v1/app-connections/jira, and POST /api/v1/app-connections/jira/{connectionId}/rotate-credentials.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint GET /api/v1/projects/{projectId}/memberships/available-users New endpoint PATCH /api/v1/agent-vault/sessions/{sessionId}
3 details in Everything
Infisical v0.167.4 makes batched secret changes always-on in Secrets Overview and moves the quick-add row to the top of the table.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.167.4 https://github.com/Infisical/infisical.git
$ git checkout v0.167.4
Enables batched secret changes as always-on behavior in the Secrets Overview, removing the need to opt in.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Moves the quick-add row to the top of the Secrets Overview table for faster secret entry.
Enables batched secret changes as always-on behavior in the Secrets Overview, removing the need to opt in.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more in Everything
Adds a v2 batch commit API, bulk secret-approval reviews, PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.167.3 https://github.com/Infisical/infisical.git
$ git checkout v0.167.3
Adds a private v2 batch commit API route for atomically committing batched secret and folder changes. Adds bulk review of change requests in secret approvals, letting reviewers approve or reject multiple requests at once. Adds auto-approvals for PAM (Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds member-provided credential fields with personal values and variables in Agent Vault. Shows group access in the organization users table.
5 details in Everything
API surface changed: +3 endpoints, −1 endpoint, 111 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}/personal-values︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}/personal-values GET /api/v1/agent-vault/access-bundles: param granted (query) added; param requiresSetup (query) added GET /api/v1/agent-vault/variables: param scope (query) added
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Removed endpoint POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/enrollment-token
Infisical v0.167.2 adds secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.167.2 https://github.com/Infisical/infisical.git
$ git checkout v0.167.2
Adds audit events for secret scanning activity tracking, giving operators a log trail for scanning operations.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Enables vault agent proxies to start using a proxy token via agent-vault proxy token support. Adds default storage configuration for vault agent session logs. Allows PKI admins to configure signer-specific code signing settings. Enables granting folder access directly from the Manage Permissions search UI.
Adds audit events for secret scanning activity tracking, giving operators a log trail for scanning operations.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Enables vault agent proxies to start using a proxy token via agent-vault proxy token support. Adds default storage configuration for vault agent session logs.
2 more in Everything
Infisical adds Agent Vault for AI agents to operate without holding credentials.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Introduces Agent Vault, enabling AI agents to run with the access, context, and capabilities they need without ever holding a credential.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 detail in Everything
Infisical v0.167.1 adds Linux Server certificate discovery to PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.167.1 https://github.com/Infisical/infisical.git
$ git checkout v0.167.1
API surface changed: +3 endpoints, 9 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
API change API surface changed: +3 endpoints, 9 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
+ GET /api/v1/cert-manager/hsm-connectors/{connectorId}/keys + POST /api/v1/cert-manager/certificates/{id}/pkcs12 + POST /api/v1/cert-manager/signers/{signerId}/certificate/import
~ DELETE /api/v1/cert-manager/certificates/{id}: response schema changed ~ DELETE /api/v1/pki/certificates/{serialNumber}: response schema changed ~ GET /api/v1/cert-manager/certificates/{id}: response schema changed ~ GET /api/v1/pki/certificates/{serialNumber}: response schema changed ~ GET /api/v1/pki/subscribers/{subscriberName}/certificates: response schema changed ~ POST /api/v1/cert-manager/certificates/{id}/application: response schema changed ~ POST /api/v1/cert-manager/signers: request body changed ~ POST /api/v1/cert-manager/signers/{signerId}/certificate/reissue: request body changed ~ POST /api/v1/projects/{projectId}/certificates/search: response schema changed
New endpoint GET /api/v1/cert-manager/hsm-connectors/{connectorId}/keys︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint POST /api/v1/cert-manager/certificates/{id}/pkcs12 New endpoint POST /api/v1/cert-manager/signers/{signerId}/certificate/import
3 details in Everything
Infisical v0.167.0 adds DigiCert HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.167.0 https://github.com/Infisical/infisical.git
$ git checkout v0.167.0
Supports using an existing DigiCert certificate and its HSM key as a signer in the code-signing workflow.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds Copy ID to alert and approval policy row menus in the certificate manager. Shows last-edited time for secrets in the single-environment overview.
Supports using an existing DigiCert certificate and its HSM key as a signer in the code-signing workflow.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
2 more in Everything
Infisical v0.166.9 adds S3 S3 Amazon's object storage service, where files are stored in named buckets and retrieved over HTTP; cyber tools use it for scalable, cheap log or artifact storage without managing a filesystem. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. AWS KMS AWS KMS AWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.166.9 https://github.com/Infisical/infisical.git
$ git checkout v0.166.9
Adds AWS KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Adds S3-compatible S3-compatible An object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. Moves variables from access bundles to Agent Vault scope as a whole, broadening where vault-level variables apply. Adds audit_log_streams table to the sanitized database schema for audit log stream support. Revamps the findings UI with a redesigned findings view.
+5 more
show less
Revamps the data store list and redesigns the data source flow. Shows offline license usage on the unified billing page. Adds page breadcrumbs to the top navigation on every route. Suggests names for secret syncs, app connections, honey tokens, certificate authorities, approval policies, and certificate policies from their context during creation. Opens the chosen plan's trial automatically after signup from the pricing page, and shows the pricing trial prompt for already-signed-in users.
Adds AWS KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Adds S3-compatible S3-compatible An object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. Adds audit_log_streams table to the sanitized database schema for audit log stream support. Adds page breadcrumbs to the top navigation on every route. Suggests names for secret syncs, app connections, honey tokens, certificate authorities, approval policies, and certificate policies from their context during creation.
+1 more
show less
Opens the chosen plan's trial automatically after signup from the pricing page, and shows the pricing trial prompt for already-signed-in users.
4 more in Everything
API surface changed: +30 endpoints, −5 endpoints, 12 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
API change API surface changed: +30 endpoints, −5 endpoints, 12 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
+ DELETE /api/v1/agent-vault/variables/{variableId} + DELETE /api/v1/app-connections/portainer/{connectionId} + DELETE /api/v1/app-connections/s3-compatible/{connectionId} + DELETE /api/v1/secret-syncs/portainer/{syncId} + GET /api/v1/agent-vault/variables + GET /api/v1/agent-vault/variables/{variableId}/value + GET /api/v1/app-connections/portainer + GET /api/v1/app-connections/portainer/available + GET /api/v1/app-connections/portainer/connection-name/{connectionName} + GET /api/v1/app-connections/portainer/{connectionId} + GET /api/v1/app-connections/s3-compatible + GET /api/v1/app-connections/s3-compatible/available + GET /api/v1/app-connections/s3-compatible/connection-name/{connectionName} + GET /api/v1/app-connections/s3-compatible/{connectionId} + GET /api/v1/secret-syncs/portainer + GET /api/v1/secret-syncs/portainer/sync-name/{syncName} + GET /api/v1/secret-syncs/portainer/{syncId} + PATCH /api/v1/agent-vault/variables/{variableId} + PATCH /api/v1/app-connections/portainer/{connectionId} + PATCH /api/v1/app-connections/s3-compatible/{connectionId} + PATCH /api/v1/secret-syncs/portainer/{syncId} + POST /api/v1/agent-vault/variables + POST /api/v1/app-connections/portainer + POST /api/v1/app-connections/portainer/{connectionId}/rotate-credentials + POST /api/v1/app-connections/s3-compatible + POST /api/v1/app-connections/s3-compatible/{connectionId}/rotate-credentials + POST /api/v1/secret-syncs/portainer + POST /api/v1/secret-syncs/portainer/{syncId}/import-secrets + POST /api/v1/secret-syncs/portainer/{syncId}/remove-secrets + POST /api/v1/secret-syncs/portainer/{syncId}/sync-secrets
~ DELETE /api/v1/cert-manager/ca/internal/{id}: response schema changed ~ DELETE /api/v1/pki/ca/internal/{caName}: response schema changed ~ GET /api/v1/cert-manager/ca/internal: response schema changed ~ GET /api/v1/cert-manager/ca/internal/{id}: response schema changed ~ GET /api/v1/cert-manager/syncs/options: response schema changed ~ GET /api/v1/pki/ca/internal: response schema changed ~ GET /api/v1/pki/ca/internal/{caName}: response schema changed ~ GET /api/v1/pki/syncs/options: response schema changed ~ PATCH /api/v1/cert-manager/ca/internal/{id}: response schema changed ~ PATCH /api/v1/pki/ca/internal/{caName}: response schema changed ~ POST /api/v1/cert-manager/ca/internal: request body changed; response schema changed ~ POST /api/v1/pki/ca/internal: request body changed; response schema changed
− DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} (breaking) − GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables (breaking) − GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}/value (breaking) − PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} (breaking) − POST /api/v1/agent-vault/access-bundles/{accessBundleId}/variables (breaking)
Adds Agent Vault variable management endpoints: GET /api/v1/agent-vault/variables, POST /api/v1/agent-vault/variables, GET /api/v1/agent-vault/variables/{variableId}/value, PATCH /api/v1/agent-vault/variables/{variableId}, and DELETE /api/v1/agent-vault/variables/{variableId}.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds Portainer app connection endpoints: GET /api/v1/app-connections/portainer, GET /api/v1/app-connections/portainer/available, GET /api/v1/app-connections/portainer/connection-name/{connectionName}, GET /api/v1/app-connections/portainer/{connectionId}, POST /api/v1/app-connections/portainer, PATCH /api/v1/app-connections/portainer/{connectionId}, DELETE /api/v1/app-connections/portainer/{connectionId}, and POST /api/v1/app-connections/portainer/{connectionId}/rotate-credentials. Adds S3-compatible S3-compatible An object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. GET /api/v1/app-connections/s3-compatible, GET /api/v1/app-connections/s3-compatible/available, GET /api/v1/app-connections/s3-compatible/connection-name/{connectionName}, GET /api/v1/app-connections/s3-compatible/{connectionId}, POST /api/v1/app-connections/s3-compatible, PATCH /api/v1/app-connections/s3-compatible/{connectionId}, DELETE /api/v1/app-connections/s3-compatible/{connectionId}, and POST /api/v1/app-connections/s3-compatible/{connectionId}/rotate-credentials. Adds Portainer secret sync endpoints: GET /api/v1/secret-syncs/portainer, GET /api/v1/secret-syncs/portainer/sync-name/{syncName}, GET /api/v1/secret-syncs/portainer/{syncId}, POST /api/v1/secret-syncs/portainer, PATCH /api/v1/secret-syncs/portainer/{syncId}, DELETE /api/v1/secret-syncs/portainer/{syncId}, POST /api/v1/secret-syncs/portainer/{syncId}/import-secrets, POST /api/v1/secret-syncs/portainer/{syncId}/remove-secrets, and POST /api/v1/secret-syncs/portainer/{syncId}/sync-secrets.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Removed endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}! Removed endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables! Removed endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}/value! Removed endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}! Removed endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/variables
Infisical v0.166.8 adds Portainer secret sync, webhook authentication with custom headers, and audit-log-stream drop alerts.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.166.8 https://github.com/Infisical/infisical.git
$ git checkout v0.166.8
Adds authentication and custom headers support to webhook alert channels.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds an alert when an audit log stream starts dropping logs. Adds Portainer as a supported secret sync app connection target. Returns all tags during secret query evaluation.
Adds authentication and custom headers support to webhook alert channels.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds an alert when an audit log stream starts dropping logs. Adds Portainer as a supported secret sync app connection target.
1 more in Everything
API surface changed: +65 endpoints, −3 endpoints, 39 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Adds Agent Vault member management endpoints: DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/members, DELETE /api/v1/agent-vault/members, and PATCH /api/v1/agent-vault/members.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds a Keeper app connection integration with endpoints GET /api/v1/app-connections/keeper, GET /api/v1/app-connections/keeper/available, GET /api/v1/app-connections/keeper/connection-name/{connectionName}, GET /api/v1/app-connections/keeper/{connectionId}, POST /api/v1/app-connections/keeper, POST /api/v1/app-connections/keeper/{connectionId}/rotate-credentials, PATCH /api/v1/app-connections/keeper/{connectionId}, and DELETE /api/v1/app-connections/keeper/{connectionId}. Adds a Palo Alto Networks app connection integration with endpoints GET /api/v1/app-connections/palo-alto-networks, GET /api/v1/app-connections/palo-alto-networks/available, GET /api/v1/app-connections/palo-alto-networks/connection-name/{connectionName}, GET /api/v1/app-connections/palo-alto-networks/{connectionId}, POST /api/v1/app-connections/palo-alto-networks, POST /api/v1/app-connections/palo-alto-networks/{connectionId}/rotate-credentials, PATCH /api/v1/app-connections/palo-alto-networks/{connectionId}, and DELETE /api/v1/app-connections/palo-alto-networks/{connectionId}. Adds Palo Alto Networks PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cert-manager and pki API namespaces: listing via GET /api/v1/cert-manager/syncs/palo-alto-networks, GET /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile, GET /api/v1/pki/syncs/palo-alto-networks, GET /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile, and their by-id variants GET /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}, GET /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}, GET /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}, GET /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}; creation via POST /api/v1/cert-manager/syncs/palo-alto-networks, POST /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile, POST /api/v1/pki/syncs/palo-alto-networks, POST /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile; sync and removal actions via POST /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}/sync, POST /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}/remove-certificates, POST /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}/sync, POST /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}/remove-certificates, POST /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}/sync, POST /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}/remove-certificates, POST /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}/sync, POST /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}/remove-certificates; updates via PATCH /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}, PATCH /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}, PATCH /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}, PATCH /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}; and deletion via DELETE /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}, DELETE /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}, DELETE /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}, DELETE /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}. Adds a Cloudflare Secrets Store secret sync with endpoints GET /api/v1/secret-syncs/cloudflare-secrets-store, GET /api/v1/secret-syncs/cloudflare-secrets-store/sync-name/{syncName}, GET /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}, POST /api/v1/secret-syncs/cloudflare-secrets-store, POST /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}/import-secrets, POST /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}/remove-secrets, POST /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}/sync-secrets, PATCH /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}, and DELETE /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}.
+1 more
show less
Adds a Keeper Password Manager secret sync with endpoints GET /api/v1/secret-syncs/keeper-password-manager, GET /api/v1/secret-syncs/keeper-password-manager/sync-name/{syncName}, GET /api/v1/secret-syncs/keeper-password-manager/{syncId}, POST /api/v1/secret-syncs/keeper-password-manager, POST /api/v1/secret-syncs/keeper-password-manager/{syncId}/import-secrets, POST /api/v1/secret-syncs/keeper-password-manager/{syncId}/remove-secrets, POST /api/v1/secret-syncs/keeper-password-manager/{syncId}/sync-secrets, PATCH /api/v1/secret-syncs/keeper-password-manager/{syncId}, and DELETE /api/v1/secret-syncs/keeper-password-manager/{syncId}.
6 details in Everything
└──▷ BREAKING ON UPGRADE
! Removed endpoint PATCH /api/v1/agent-vault/members/{actorType}/{actorId}! Removed endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members/revoke! Removed endpoint POST /api/v1/agent-vault/members/revoke! GET /api/v1/agent-vault/sessions/{sessionId}/logs: param limit (query) removed; response schema changed! GET /api/v1/agent-vault/sessions/{sessionId}/logs/tail: param limit (query) removed; response schema changed
Adds PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.166.7 https://github.com/Infisical/infisical.git
$ git checkout v0.166.7
Moves PAM to a dedicated alerting module. Adds an edit secret sheet and comment preview in the single-environment secrets view. Requires a cancellation reason when cancelling a subscription via the Billing V2 cancel dialogs.
3 details in Everything
Infisical v0.166.6 adds MSSQL PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. OpenRouter OpenRouter A unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.166.6 https://github.com/Infisical/infisical.git
$ git checkout v0.166.6
└──▷ HOW TO FIND IT
Navigate to the PAM section to run MSSQL discovery and surface MSSQL credentials under managed accounts.
📍 In the Infisical console, go to Privileged Access Management › Discovery, select MSSQL as the discovery target, and run the scan.
Set up a Palo Alto Networks certificate sync to automatically push PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
📍 In the Infisical console, go to PKI › Certificate Syncs › New Sync, choose Palo Alto Networks as the app connection, configure the target and save.
Adds MSSQL discovery for Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds Palo Alto Networks app connection and certificate syncs via the PKI sync subsystem. Adds workspace support for OpenRouter secret rotation. Supports encrypted data bags in the Chef secret sync integration. Splits project templates by product type in the UI for clearer onboarding.
Adds MSSQL discovery for Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds Palo Alto Networks app connection and certificate syncs via the PKI sync subsystem.
3 more in Everything
└──▷ BREAKING ON UPGRADE
! Agent/Vault member revocation now uses DELETE (previously a different method); roles can now only be changed in bulk — existing single-member role-change workflows may break.! Agent/Vault: every variable is now treated as a secret — previously non-secret variables will be reclassified on upgrade.
Infisical v0.166.5 moves secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.166.5 https://github.com/Infisical/infisical.git
$ git checkout v0.166.5
Moves secret scanning to a single-project product scope, scoping all scanning operations and results to individual projects.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Supports importing nested JSON objects as folder hierarchies when importing secrets.
Moves secret scanning to a single-project product scope, scoping all scanning operations and results to individual projects.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
1 more in Everything
API surface changed: +18 endpoints, 21 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
API change API surface changed: +18 endpoints, 21 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
+ DELETE /api/v1/app-connections/hpe-ilo/{connectionId} + DELETE /api/v2/secret-rotations/gcp-service-account-key/{rotationId} + GET /api/v1/app-connections/hpe-ilo + GET /api/v1/app-connections/hpe-ilo/available + GET /api/v1/app-connections/hpe-ilo/connection-name/{connectionName} + GET /api/v1/app-connections/hpe-ilo/{connectionId} + GET /api/v2/secret-rotations/gcp-service-account-key + GET /api/v2/secret-rotations/gcp-service-account-key/rotation-name/{rotationName} + GET /api/v2/secret-rotations/gcp-service-account-key/{rotationId} + GET /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/generated-credentials + PATCH /api/v1/app-connections/hpe-ilo/{connectionId} + PATCH /api/v2/secret-rotations/gcp-service-account-key/{rotationId} + POST /api/v1/app-connections/hpe-ilo + POST /api/v1/app-connections/hpe-ilo/{connectionId}/rotate-credentials + POST /api/v2/secret-rotations/gcp-service-account-key + POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/check-credentials + POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/move + POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/rotate-secrets
~ DELETE /api/v1/cert-manager/ca/acme/{id}: response schema changed ~ DELETE /api/v1/pki/ca/acme/{caName}: response schema changed ~ DELETE /api/v2/secret-rotations/hp-ilo-local-account/{rotationId}: response schema changed ~ GET /api/v1/cert-manager/ca/acme: response schema changed ~ GET /api/v1/cert-manager/ca/acme/{id}: response schema changed ~ GET /api/v1/cert-manager/syncs/options: response schema changed ~ GET /api/v1/pki/ca/acme: response schema changed ~ GET /api/v1/pki/ca/acme/{caName}: response schema changed ~ GET /api/v1/pki/syncs/options: response schema changed ~ GET /api/v2/secret-rotations/hp-ilo-local-account: response schema changed ~ GET /api/v2/secret-rotations/hp-ilo-local-account/rotation-name/{rotationName}: response schema changed ~ GET /api/v2/secret-rotations/hp-ilo-local-account/{rotationId}: response schema changed ~ PATCH /api/v1/cert-manager/ca/acme/{id}: request body changed; response schema changed ~ PATCH /api/v1/pki/ca/acme/{caName}: request body changed; response schema changed ~ PATCH /api/v2/secret-rotations/hp-ilo-local-account/{rotationId}: response schema changed ~ POST /api/v1/cert-manager/ca/acme: request body changed; response schema changed ~ POST /api/v1/pki/ca/acme: request body changed; response schema changed ~ POST /api/v2/secret-rotations/hp-ilo-local-account: response schema changed ~ POST /api/v2/secret-rotations/hp-ilo-local-account/{rotationId}/move: response schema changed ~ POST /api/v2/secret-rotations/hp-ilo-local-account/{rotationId}/reconcile: response schema changed ~ POST /api/v2/secret-rotations/hp-ilo-local-account/{rotationId}/rotate-secrets: response schema changed
New endpoint DELETE /api/v1/app-connections/hpe-ilo/{connectionId}︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint DELETE /api/v2/secret-rotations/gcp-service-account-key/{rotationId} New endpoint GET /api/v1/app-connections/hpe-ilo New endpoint GET /api/v1/app-connections/hpe-ilo/available New endpoint GET /api/v1/app-connections/hpe-ilo/connection-name/{connectionName}
+13 more
show less
New endpoint GET /api/v1/app-connections/hpe-ilo/{connectionId} New endpoint GET /api/v2/secret-rotations/gcp-service-account-key New endpoint GET /api/v2/secret-rotations/gcp-service-account-key/rotation-name/{rotationName} New endpoint GET /api/v2/secret-rotations/gcp-service-account-key/{rotationId} New endpoint GET /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/generated-credentials New endpoint PATCH /api/v1/app-connections/hpe-ilo/{connectionId} New endpoint PATCH /api/v2/secret-rotations/gcp-service-account-key/{rotationId} New endpoint POST /api/v1/app-connections/hpe-ilo New endpoint POST /api/v1/app-connections/hpe-ilo/{connectionId}/rotate-credentials New endpoint POST /api/v2/secret-rotations/gcp-service-account-key New endpoint POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/check-credentials New endpoint POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/move New endpoint POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/rotate-secrets
18 details in Everything
Adds Ed25519 Ed25519 A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.166.3 https://github.com/Infisical/infisical.git
$ git checkout v0.166.3
Adds Ed25519 sign/verify key support in KMS, enabling elliptic-curve signing operations. Adds GCP service account key rotation to the secret rotation engine. Adds support for multiple connections in a single secret rotation configuration. Warns users before moving or copying secrets into a synced path, preventing unintended sync overwrites.
4 details in Everything
Infisical v0.165.17 adds OCSP OCSP A protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.17 https://github.com/Infisical/infisical.git
$ git checkout v0.165.17
Adds a members/available API endpoint on agent-vault so add-member dialogs surface only unassigned actors.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds an OCSP responder for internal certificate authorities. Adds Stripe app connection and API key rotation to secret-rotation. Adds access bundle variables to agent-vault. Adds an agent-friendly API (feat(api): agent friendly api).
+9 more
show less
Records external CA issued values and drops issuer-written extensions on renewal. Adds token-auth credential expiry and support for multiple alerts per machine identity. Terminates PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Moves application alerts to the shared alerting module. Adds resizable columns to the secrets table. Adds opt-in sticky header to tables. Redesigns the move-destination picker for secrets. Adds environment-scoped recency sorting for secrets. Overhauled secret-sharing UX across surfaces.
Adds a members/available API endpoint on agent-vault so add-member dialogs surface only unassigned actors.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds an OCSP responder for internal certificate authorities. Adds Stripe app connection and API key rotation to secret-rotation. Adds access bundle variables to agent-vault. Adds an agent-friendly API (feat(api): agent friendly api).
+4 more
show less
Records external CA issued values and drops issuer-written extensions on renewal. Terminates PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds resizable columns to the secrets table. Adds opt-in sticky header to tables.
5 more in Everything
API change
+ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} + DELETE /api/v1/agent-vault/app-connections/aws/{connectionId} + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}/value + GET /api/v1/agent-vault/app-connections/aws + GET /api/v1/agent-vault/app-connections/aws/{connectionId} + GET /api/v1/agent-vault/sessions/{sessionId} + GET /api/v1/agent-vault/sessions/{sessionId}/logs + GET /api/v1/agent-vault/sessions/{sessionId}/logs/tail + GET /api/v1/agent-vault/settings/session-logs + PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} + PATCH /api/v1/agent-vault/app-connections/aws/{connectionId} + PATCH /api/v1/agent-vault/settings/session-logs + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/variables + POST /api/v1/agent-vault/app-connections/aws
~ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: response schema changed ~ DELETE /api/v1/projects/{projectId}: response schema changed ~ DELETE /api/v1/workspace/{workspaceId}: response schema changed ~ DELETE /api/v2/workspace/{slug}: response schema changed ~ GET /api/v1/agent-vault/access-bundles/{accessBundleId}: response schema changed ~ GET /api/v1/agent-vault/sessions: response schema changed ~ GET /api/v1/projects: response schema changed ~ GET /api/v1/projects/slug/{slug}: response schema changed ~ GET /api/v1/projects/{projectId}: response schema changed ~ GET /api/v1/workspace/{workspaceId}: response schema changed ~ PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: response schema changed ~ PATCH /api/v1/projects/{projectId}: response schema changed ~ PATCH /api/v1/workspace/{workspaceId}: response schema changed ~ POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services: response schema changed ~ POST /api/v1/agent-vault/sessions/{sessionId}/revoke: response schema changed ~ POST /api/v1/projects: response schema changed
⚠ DELETE /api/v1/cert-manager/alerts/{alertId} ⚠ DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} ⚠ GET /api/v1/cert-manager/alerts ⚠ GET /api/v1/cert-manager/alerts/{alertId} ⚠ GET /api/v1/cert-manager/applications/{applicationId}/alerts ⚠ PATCH /api/v1/cert-manager/alerts/{alertId} ⚠ PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} ⚠ POST /api/v1/cert-manager/alerts ⚠ POST /api/v1/cert-manager/applications/{applicationId}/alerts
└──▷ BREAKING ON UPGRADE
! Deprecated endpoint DELETE /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works)! Deprecated endpoint GET /api/v1/cert-manager/alerts (still works)! Deprecated endpoint GET /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint GET /api/v1/cert-manager/applications/{applicationId}/alerts (still works)! Deprecated endpoint PATCH /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works)! Deprecated endpoint POST /api/v1/cert-manager/alerts (still works)! Deprecated endpoint POST /api/v1/cert-manager/applications/{applicationId}/alerts (still works)
API change
+ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} + DELETE /api/v1/agent-vault/app-connections/aws/{connectionId} + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}/value + GET /api/v1/agent-vault/app-connections/aws + GET /api/v1/agent-vault/app-connections/aws/{connectionId} + GET /api/v1/agent-vault/sessions/{sessionId} + GET /api/v1/agent-vault/sessions/{sessionId}/logs + GET /api/v1/agent-vault/sessions/{sessionId}/logs/tail + GET /api/v1/agent-vault/settings/session-logs + PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} + PATCH /api/v1/agent-vault/app-connections/aws/{connectionId} + PATCH /api/v1/agent-vault/settings/session-logs + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/variables + POST /api/v1/agent-vault/app-connections/aws
~ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: response schema changed ~ DELETE /api/v1/projects/{projectId}: response schema changed ~ DELETE /api/v1/workspace/{workspaceId}: response schema changed ~ DELETE /api/v2/workspace/{slug}: response schema changed ~ GET /api/v1/agent-vault/access-bundles/{accessBundleId}: response schema changed ~ GET /api/v1/agent-vault/sessions: response schema changed ~ GET /api/v1/projects: response schema changed ~ GET /api/v1/projects/slug/{slug}: response schema changed ~ GET /api/v1/projects/{projectId}: response schema changed ~ GET /api/v1/workspace/{workspaceId}: response schema changed ~ PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: response schema changed ~ PATCH /api/v1/projects/{projectId}: response schema changed ~ PATCH /api/v1/workspace/{workspaceId}: response schema changed ~ POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services: response schema changed ~ POST /api/v1/agent-vault/sessions/{sessionId}/revoke: response schema changed ~ POST /api/v1/projects: response schema changed
⚠ DELETE /api/v1/cert-manager/alerts/{alertId} ⚠ DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} ⚠ GET /api/v1/cert-manager/alerts ⚠ GET /api/v1/cert-manager/alerts/{alertId} ⚠ GET /api/v1/cert-manager/applications/{applicationId}/alerts ⚠ PATCH /api/v1/cert-manager/alerts/{alertId} ⚠ PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} ⚠ POST /api/v1/cert-manager/alerts ⚠ POST /api/v1/cert-manager/applications/{applicationId}/alerts
└──▷ BREAKING ON UPGRADE
! Deprecated endpoint DELETE /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works)! Deprecated endpoint GET /api/v1/cert-manager/alerts (still works)! Deprecated endpoint GET /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint GET /api/v1/cert-manager/applications/{applicationId}/alerts (still works)! Deprecated endpoint PATCH /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works)! Deprecated endpoint POST /api/v1/cert-manager/alerts (still works)! Deprecated endpoint POST /api/v1/cert-manager/applications/{applicationId}/alerts (still works)
API surface changed: +15 endpoints, 16 modified, 9 deprecated︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
API change API surface changed: +15 endpoints, 16 modified, 9 deprecated︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
+ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} + DELETE /api/v1/agent-vault/app-connections/aws/{connectionId} + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}/value + GET /api/v1/agent-vault/app-connections/aws + GET /api/v1/agent-vault/app-connections/aws/{connectionId} + GET /api/v1/agent-vault/sessions/{sessionId} + GET /api/v1/agent-vault/sessions/{sessionId}/logs + GET /api/v1/agent-vault/sessions/{sessionId}/logs/tail + GET /api/v1/agent-vault/settings/session-logs + PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} + PATCH /api/v1/agent-vault/app-connections/aws/{connectionId} + PATCH /api/v1/agent-vault/settings/session-logs + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/variables + POST /api/v1/agent-vault/app-connections/aws
~ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: response schema changed ~ DELETE /api/v1/projects/{projectId}: response schema changed ~ DELETE /api/v1/workspace/{workspaceId}: response schema changed ~ DELETE /api/v2/workspace/{slug}: response schema changed ~ GET /api/v1/agent-vault/access-bundles/{accessBundleId}: response schema changed ~ GET /api/v1/agent-vault/sessions: response schema changed ~ GET /api/v1/projects: response schema changed ~ GET /api/v1/projects/slug/{slug}: response schema changed ~ GET /api/v1/projects/{projectId}: response schema changed ~ GET /api/v1/workspace/{workspaceId}: response schema changed ~ PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: response schema changed ~ PATCH /api/v1/projects/{projectId}: response schema changed ~ PATCH /api/v1/workspace/{workspaceId}: response schema changed ~ POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services: response schema changed ~ POST /api/v1/agent-vault/sessions/{sessionId}/revoke: response schema changed ~ POST /api/v1/projects: response schema changed
⚠ DELETE /api/v1/cert-manager/alerts/{alertId} ⚠ DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} ⚠ GET /api/v1/cert-manager/alerts ⚠ GET /api/v1/cert-manager/alerts/{alertId} ⚠ GET /api/v1/cert-manager/applications/{applicationId}/alerts ⚠ PATCH /api/v1/cert-manager/alerts/{alertId} ⚠ PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} ⚠ POST /api/v1/cert-manager/alerts ⚠ POST /api/v1/cert-manager/applications/{applicationId}/alerts
New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint DELETE /api/v1/agent-vault/app-connections/aws/{connectionId} New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}/value New endpoint GET /api/v1/agent-vault/app-connections/aws
+10 more
show less
New endpoint GET /api/v1/agent-vault/app-connections/aws/{connectionId} New endpoint GET /api/v1/agent-vault/sessions/{sessionId} New endpoint GET /api/v1/agent-vault/sessions/{sessionId}/logs New endpoint GET /api/v1/agent-vault/sessions/{sessionId}/logs/tail New endpoint GET /api/v1/agent-vault/settings/session-logs New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} New endpoint PATCH /api/v1/agent-vault/app-connections/aws/{connectionId} New endpoint PATCH /api/v1/agent-vault/settings/session-logs New endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/variables New endpoint POST /api/v1/agent-vault/app-connections/aws
15 details in Everything
└──▷ BREAKING ON UPGRADE
! Deprecated endpoint DELETE /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works)! Deprecated endpoint GET /api/v1/cert-manager/alerts (still works)! Deprecated endpoint GET /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint GET /api/v1/cert-manager/applications/{applicationId}/alerts (still works)! Deprecated endpoint PATCH /api/v1/cert-manager/alerts/{alertId} (still works)! Deprecated endpoint PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works)! Deprecated endpoint POST /api/v1/cert-manager/alerts (still works)! Deprecated endpoint POST /api/v1/cert-manager/applications/{applicationId}/alerts (still works)
API surface changed: +19 endpoints, −37 endpoints, 19 modified, 12 deprecated︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
API change API surface changed: +19 endpoints, −37 endpoints, 19 modified, 12 deprecated︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
+ DELETE /api/v1/app-connections/stripe/{connectionId} + DELETE /api/v2/secret-rotations/stripe-api-key/{rotationId} + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/members/available + GET /api/v1/app-connections/stripe + GET /api/v1/app-connections/stripe/available + GET /api/v1/app-connections/stripe/connection-name/{connectionName} + GET /api/v1/app-connections/stripe/{connectionId} + GET /api/v2/secret-rotations/stripe-api-key + GET /api/v2/secret-rotations/stripe-api-key/rotation-name/{rotationName} + GET /api/v2/secret-rotations/stripe-api-key/{rotationId} + GET /api/v2/secret-rotations/stripe-api-key/{rotationId}/generated-credentials + PATCH /api/v1/app-connections/stripe/{connectionId} + PATCH /api/v2/secret-rotations/stripe-api-key/{rotationId} + POST /api/v1/app-connections/stripe + POST /api/v1/app-connections/stripe/{connectionId}/rotate-credentials + POST /api/v2/secret-rotations/stripe-api-key + POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/check-credentials + POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/move + POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/rotate-secrets
~ DELETE /api/v1/cert-manager/ca/internal/{id}: response schema changed ~ DELETE /api/v1/pki/ca/internal/{caName}: response schema changed ~ DELETE /api/v1/pki/ca/{caId}: response schema changed ~ GET /api/v1/cert-manager/ca/internal: response schema changed ~ GET /api/v1/cert-manager/ca/internal/{id}: response schema changed ~ GET /api/v1/cert-manager/syncs/options: response schema changed ~ GET /api/v1/pki/ca/internal: response schema changed ~ GET /api/v1/pki/ca/internal/{caName}: response schema changed ~ GET /api/v1/pki/ca/{caId}: response schema changed ~ GET /api/v1/pki/syncs/options: response schema changed ~ GET /api/v1/projects/{projectId}/cas: response schema changed ~ GET /api/v2/workspace/{slug}/cas: response schema changed ~ PATCH /api/v1/cert-manager/ca/internal/{id}: request body changed; response schema changed ~ PATCH /api/v1/pki/ca/internal/{caName}: response schema changed ~ PATCH /api/v1/pki/ca/{caId}: response schema changed ~ PATCH /api/v3/gateways/{gatewayId}: request body changed ~ POST /api/v1/cert-manager/ca/internal: request body changed; response schema changed ~ POST /api/v1/pki/ca: response schema changed ~ POST /api/v1/pki/ca/internal: request body changed; response schema changed
⚠ DELETE /api/v3/secrets/batch/raw ⚠ DELETE /api/v3/secrets/raw/{secretName} ⚠ DELETE /api/v3/secrets/tags/{secretName} ⚠ GET /api/v3/secrets/raw ⚠ GET /api/v3/secrets/raw/id/{secretId} ⚠ GET /api/v3/secrets/raw/{secretName} ⚠ PATCH /api/v3/secrets/batch/raw ⚠ PATCH /api/v3/secrets/raw/{secretName} ⚠ POST /api/v3/secrets/batch/raw ⚠ POST /api/v3/secrets/move ⚠ POST /api/v3/secrets/raw/{secretName} ⚠ POST /api/v3/secrets/tags/{secretName}
− DELETE /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId} (breaking) − DELETE /api/v2/secret-scanning/data-sources/github/{dataSourceId} (breaking) − DELETE /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId} (breaking) − GET /api/v2/secret-scanning/configs (breaking) − GET /api/v2/secret-scanning/data-sources (breaking) − GET /api/v2/secret-scanning/data-sources/bitbucket (breaking) − GET /api/v2/secret-scanning/data-sources/bitbucket/data-source-name/{sourceName} (breaking) − GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId} (breaking) − GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/resources (breaking) − GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/scans (breaking) − GET /api/v2/secret-scanning/data-sources/github (breaking) − GET /api/v2/secret-scanning/data-sources/github/data-source-name/{sourceName} (breaking) − GET /api/v2/secret-scanning/data-sources/github/{dataSourceId} (breaking) − GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}/resources (breaking) − GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}/scans (breaking) − GET /api/v2/secret-scanning/data-sources/gitlab (breaking) − GET /api/v2/secret-scanning/data-sources/gitlab/data-source-name/{sourceName} (breaking) − GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId} (breaking) − GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/resources (breaking) − GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/scans (breaking) − GET /api/v2/secret-scanning/data-sources/options (breaking) − GET /api/v2/secret-scanning/findings (breaking) − PATCH /api/v2/secret-scanning/configs (breaking) − PATCH /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId} (breaking) − PATCH /api/v2/secret-scanning/data-sources/github/{dataSourceId} (breaking) − PATCH /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId} (breaking) − PATCH /api/v2/secret-scanning/findings (breaking) − PATCH /api/v2/secret-scanning/findings/{findingId} (breaking) − POST /api/v2/secret-scanning/data-sources/bitbucket (breaking) − POST /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/resources/{resourceId}/scan (breaking) − POST /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/scan (breaking) − POST /api/v2/secret-scanning/data-sources/github (breaking) − POST /api/v2/secret-scanning/data-sources/github/{dataSourceId}/resources/{resourceId}/scan (breaking) − POST /api/v2/secret-scanning/data-sources/github/{dataSourceId}/scan (breaking) − POST /api/v2/secret-scanning/data-sources/gitlab (breaking) − POST /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/resources/{resourceId}/scan (breaking) − POST /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/scan (breaking)
New endpoint DELETE /api/v1/app-connections/stripe/{connectionId}︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint DELETE /api/v2/secret-rotations/stripe-api-key/{rotationId} New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/members/available New endpoint GET /api/v1/app-connections/stripe New endpoint GET /api/v1/app-connections/stripe/available
+14 more
show less
New endpoint GET /api/v1/app-connections/stripe/connection-name/{connectionName} New endpoint GET /api/v1/app-connections/stripe/{connectionId} New endpoint GET /api/v2/secret-rotations/stripe-api-key New endpoint GET /api/v2/secret-rotations/stripe-api-key/rotation-name/{rotationName} New endpoint GET /api/v2/secret-rotations/stripe-api-key/{rotationId} New endpoint GET /api/v2/secret-rotations/stripe-api-key/{rotationId}/generated-credentials New endpoint PATCH /api/v1/app-connections/stripe/{connectionId} New endpoint PATCH /api/v2/secret-rotations/stripe-api-key/{rotationId} New endpoint POST /api/v1/app-connections/stripe New endpoint POST /api/v1/app-connections/stripe/{connectionId}/rotate-credentials New endpoint POST /api/v2/secret-rotations/stripe-api-key New endpoint POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/check-credentials New endpoint POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/move New endpoint POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/rotate-secrets
19 details in Everything
└──▷ BREAKING ON UPGRADE
! Removed endpoint DELETE /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}! Removed endpoint DELETE /api/v2/secret-scanning/data-sources/github/{dataSourceId}! Removed endpoint DELETE /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}! Removed endpoint GET /api/v2/secret-scanning/configs! Removed endpoint GET /api/v2/secret-scanning/data-sources! Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket! Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket/data-source-name/{sourceName}! Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}! Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/resources! Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/scans! Removed endpoint GET /api/v2/secret-scanning/data-sources/github! Removed endpoint GET /api/v2/secret-scanning/data-sources/github/data-source-name/{sourceName}! Removed endpoint GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}! Removed endpoint GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}/resources! Removed endpoint GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}/scans! Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab! Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab/data-source-name/{sourceName}! Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}! Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/resources! Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/scans! Removed endpoint GET /api/v2/secret-scanning/data-sources/options! Removed endpoint GET /api/v2/secret-scanning/findings! Removed endpoint PATCH /api/v2/secret-scanning/configs! Removed endpoint PATCH /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}! Removed endpoint PATCH /api/v2/secret-scanning/data-sources/github/{dataSourceId}! Removed endpoint PATCH /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}! Removed endpoint PATCH /api/v2/secret-scanning/findings! Removed endpoint PATCH /api/v2/secret-scanning/findings/{findingId}! Removed endpoint POST /api/v2/secret-scanning/data-sources/bitbucket! Removed endpoint POST /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/resources/{resourceId}/scan! Removed endpoint POST /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/scan! Removed endpoint POST /api/v2/secret-scanning/data-sources/github! Removed endpoint POST /api/v2/secret-scanning/data-sources/github/{dataSourceId}/resources/{resourceId}/scan! Removed endpoint POST /api/v2/secret-scanning/data-sources/github/{dataSourceId}/scan! Removed endpoint POST /api/v2/secret-scanning/data-sources/gitlab! Removed endpoint POST /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/resources/{resourceId}/scan! Removed endpoint POST /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/scan! Deprecated endpoint DELETE /api/v3/secrets/batch/raw (still works)! Deprecated endpoint DELETE /api/v3/secrets/raw/{secretName} (still works)! Deprecated endpoint DELETE /api/v3/secrets/tags/{secretName} (still works)! Deprecated endpoint GET /api/v3/secrets/raw (still works)! Deprecated endpoint GET /api/v3/secrets/raw/id/{secretId} (still works)! Deprecated endpoint GET /api/v3/secrets/raw/{secretName} (still works)! Deprecated endpoint PATCH /api/v3/secrets/batch/raw (still works)! Deprecated endpoint PATCH /api/v3/secrets/raw/{secretName} (still works)! Deprecated endpoint POST /api/v3/secrets/batch/raw (still works)! Deprecated endpoint POST /api/v3/secrets/move (still works)! Deprecated endpoint POST /api/v3/secrets/raw/{secretName} (still works)! Deprecated endpoint POST /api/v3/secrets/tags/{secretName} (still works)
API change
+ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId} + DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} + DELETE /api/v1/agent-vault/proxies/{proxyId} + GET /api/status + GET /api/v1/agent-vault/access-bundles + GET /api/v1/agent-vault/access-bundles/{accessBundleId} + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/members + GET /api/v1/agent-vault/members + GET /api/v1/agent-vault/members/available + GET /api/v1/agent-vault/proxies + GET /api/v1/agent-vault/sessions + GET /api/v1/identities/details + PATCH /api/v1/agent-vault/access-bundles/{accessBundleId} + PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} + PATCH /api/v1/agent-vault/members/{actorType}/{actorId} + PATCH /api/v1/agent-vault/proxies/{proxyId} + POST /api/v1/agent-vault/access-bundles + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members/revoke + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services + POST /api/v1/agent-vault/members + POST /api/v1/agent-vault/members/revoke + POST /api/v1/agent-vault/proxies + POST /api/v1/agent-vault/proxies/{proxyId}/revoke + POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/enrollment-token + POST /api/v1/agent-vault/sessions + POST /api/v1/agent-vault/sessions/{sessionId}/revoke
~ GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/scans: response schema changed ~ GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}/scans: response schema changed ~ GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/scans: response schema changed
⚠ DELETE /api/v1/pki/certificate-templates/{certificateTemplateId} ⚠ DELETE /api/v1/pki/subscribers/{subscriberName} ⚠ DELETE /api/v2/pki/certificate-templates/{templateName} ⚠ GET /api/v1/pki/certificate-templates/{certificateTemplateId} ⚠ GET /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config ⚠ GET /api/v1/pki/subscribers/{subscriberName} ⚠ GET /api/v1/pki/subscribers/{subscriberName}/certificates ⚠ GET /api/v1/pki/subscribers/{subscriberName}/latest-certificate-bundle ⚠ GET /api/v2/pki/certificate-templates ⚠ GET /api/v2/pki/certificate-templates/{templateName} ⚠ PATCH /api/v1/pki/certificate-templates/{certificateTemplateId} ⚠ PATCH /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config ⚠ PATCH /api/v1/pki/subscribers/{subscriberName} ⚠ PATCH /api/v2/pki/certificate-templates/{templateName} ⚠ POST /api/v1/pki/certificate-templates ⚠ POST /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config ⚠ POST /api/v1/pki/subscribers ⚠ POST /api/v1/pki/subscribers/{subscriberName}/issue-certificate ⚠ POST /api/v1/pki/subscribers/{subscriberName}/order-certificate ⚠ POST /api/v1/pki/subscribers/{subscriberName}/sign-certificate ⚠ POST /api/v2/pki/certificate-templates ⚠ POST /api/v2/pki/certificate-templates/{templateName}/issue-certificate ⚠ POST /api/v2/pki/certificate-templates/{templateName}/sign-certificate
└──▷ BREAKING ON UPGRADE
! Deprecated endpoint DELETE /api/v1/pki/certificate-templates/{certificateTemplateId} (still works)! Deprecated endpoint DELETE /api/v1/pki/subscribers/{subscriberName} (still works)! Deprecated endpoint DELETE /api/v2/pki/certificate-templates/{templateName} (still works)! Deprecated endpoint GET /api/v1/pki/certificate-templates/{certificateTemplateId} (still works)! Deprecated endpoint GET /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config (still works)! Deprecated endpoint GET /api/v1/pki/subscribers/{subscriberName} (still works)! Deprecated endpoint GET /api/v1/pki/subscribers/{subscriberName}/certificates (still works)! Deprecated endpoint GET /api/v1/pki/subscribers/{subscriberName}/latest-certificate-bundle (still works)! Deprecated endpoint GET /api/v2/pki/certificate-templates (still works)! Deprecated endpoint GET /api/v2/pki/certificate-templates/{templateName} (still works)! Deprecated endpoint PATCH /api/v1/pki/certificate-templates/{certificateTemplateId} (still works)! Deprecated endpoint PATCH /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config (still works)! Deprecated endpoint PATCH /api/v1/pki/subscribers/{subscriberName} (still works)! Deprecated endpoint PATCH /api/v2/pki/certificate-templates/{templateName} (still works)! Deprecated endpoint POST /api/v1/pki/certificate-templates (still works)! Deprecated endpoint POST /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config (still works)! Deprecated endpoint POST /api/v1/pki/subscribers (still works)! Deprecated endpoint POST /api/v1/pki/subscribers/{subscriberName}/issue-certificate (still works)! Deprecated endpoint POST /api/v1/pki/subscribers/{subscriberName}/order-certificate (still works)! Deprecated endpoint POST /api/v1/pki/subscribers/{subscriberName}/sign-certificate (still works)! Deprecated endpoint POST /api/v2/pki/certificate-templates (still works)! Deprecated endpoint POST /api/v2/pki/certificate-templates/{templateName}/issue-certificate (still works)! Deprecated endpoint POST /api/v2/pki/certificate-templates/{templateName}/sign-certificate (still works)
API surface changed: +27 endpoints, 3 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
API change API surface changed: +27 endpoints, 3 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
+ DELETE /api/v1/agent-vault/access-bundles/{accessBundleId} + DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} + DELETE /api/v1/agent-vault/proxies/{proxyId} + GET /api/status + GET /api/v1/agent-vault/access-bundles + GET /api/v1/agent-vault/access-bundles/{accessBundleId} + GET /api/v1/agent-vault/access-bundles/{accessBundleId}/members + GET /api/v1/agent-vault/members + GET /api/v1/agent-vault/members/available + GET /api/v1/agent-vault/proxies + GET /api/v1/agent-vault/sessions + GET /api/v1/identities/details + PATCH /api/v1/agent-vault/access-bundles/{accessBundleId} + PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} + PATCH /api/v1/agent-vault/members/{actorType}/{actorId} + PATCH /api/v1/agent-vault/proxies/{proxyId} + POST /api/v1/agent-vault/access-bundles + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members/revoke + POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services + POST /api/v1/agent-vault/members + POST /api/v1/agent-vault/members/revoke + POST /api/v1/agent-vault/proxies + POST /api/v1/agent-vault/proxies/{proxyId}/revoke + POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/enrollment-token + POST /api/v1/agent-vault/sessions + POST /api/v1/agent-vault/sessions/{sessionId}/revoke
~ GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/scans: response schema changed ~ GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}/scans: response schema changed ~ GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/scans: response schema changed
New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} New endpoint DELETE /api/v1/agent-vault/proxies/{proxyId} New endpoint GET /api/status New endpoint GET /api/v1/agent-vault/access-bundles
+22 more
show less
New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId} New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/members New endpoint GET /api/v1/agent-vault/members New endpoint GET /api/v1/agent-vault/members/available New endpoint GET /api/v1/agent-vault/proxies New endpoint GET /api/v1/agent-vault/sessions New endpoint GET /api/v1/identities/details New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId} New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} New endpoint PATCH /api/v1/agent-vault/members/{actorType}/{actorId} New endpoint PATCH /api/v1/agent-vault/proxies/{proxyId} New endpoint POST /api/v1/agent-vault/access-bundles New endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members New endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members/revoke New endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services New endpoint POST /api/v1/agent-vault/members New endpoint POST /api/v1/agent-vault/members/revoke New endpoint POST /api/v1/agent-vault/proxies New endpoint POST /api/v1/agent-vault/proxies/{proxyId}/revoke New endpoint POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/enrollment-token New endpoint POST /api/v1/agent-vault/sessions New endpoint POST /api/v1/agent-vault/sessions/{sessionId}/revoke
27 details in Everything
Infisical v0.165.16 adds GCP gateway enrollment, ClickHouse PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.16 https://github.com/Infisical/infisical.git
$ git checkout v0.165.16
Adds GCP enrollment support for the Infisical Gateway, enabling GCP-based infrastructure to join the gateway network.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds ClickHouse as a supported target for Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Blocks certificate deletion until the certificate has expired, preventing premature removal of active certificates. Adds batching to secret scanning, improving throughput for large-scale secret scan operations. Surfaces the Include All Subfolders option for secret sync in the UI, making subfolder sync behavior configurable without API access.
+1 more
show less
Simplifies the resource creation menu in the secrets UI, reducing the steps needed to add new resources.
Adds GCP enrollment support for the Infisical Gateway, enabling GCP-based infrastructure to join the gateway network.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds ClickHouse as a supported target for Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Blocks certificate deletion until the certificate has expired, preventing premature removal of active certificates.
3 more in Everything
Infisical v0.165.15 adds built-in PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.15 https://github.com/Infisical/infisical.git
$ git checkout v0.165.15
Adds built-in PAM masking to protect privileged access credentials from being exposed in the UI.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds a navbar theme toggle so users can switch themes directly from the navigation bar. Removes the stuck timeout environment variable, eliminating a previously required workaround.
Adds built-in PAM masking to protect privileged access credentials from being exposed in the UI.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds a navbar theme toggle so users can switch themes directly from the navigation bar.
1 more in Everything
API surface changed: +8 endpoints, 470 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
New endpoint DELETE /api/v1/app-connections/powerdns/{connectionId}︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint GET /api/v1/app-connections/powerdns New endpoint GET /api/v1/app-connections/powerdns/available New endpoint GET /api/v1/app-connections/powerdns/connection-name/{connectionName} New endpoint GET /api/v1/app-connections/powerdns/{connectionId}
+3 more
show less
New endpoint PATCH /api/v1/app-connections/powerdns/{connectionId} New endpoint POST /api/v1/app-connections/powerdns New endpoint POST /api/v1/app-connections/powerdns/{connectionId}/rotate-credentials
8 details in Everything
Infisical v0.165.14 adds PowerDNS DNS-01 DNS-01 An ACME protocol challenge type that proves domain ownership by having the requester publish a specific TXT record in DNS, letting cyber tools obtain TLS certificates for hosts that may not be publicly reachable over HTTP.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.14 https://github.com/Infisical/infisical.git
$ git checkout v0.165.14
Adds PowerDNS as a DNS-01 provider for ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. Adds method and path rules, custom headers, and substitutions to Agent Vault for fine-grained request routing and transformation control. Adds a transactional event outbox and event-triggered alerts for automated notifications on secret or infrastructure events. Adds billing v2 usage breakdown and organization listing via a new API implementation. Simplifies bulk secret selection and adds clipboard copying to the secrets UI.
Adds PowerDNS as a DNS-01 provider for ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. Adds a transactional event outbox and event-triggered alerts for automated notifications on secret or infrastructure events. Adds billing v2 usage breakdown and organization listing via a new API implementation.
2 more in Everything
Infisical v0.165.13 adds light mode, recursive secret syncs, per-org secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.13 https://github.com/Infisical/infisical.git
$ git checkout v0.165.13
Adds a 'unique values across the whole project' validation rule to enforce that a secret value is not duplicated in any other secret within the project.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds recursive secret syncs (stage one), enabling secret sync jobs to traverse nested folder structures. Adds the ability to filter which certificates are chosen when configuring PKI syncs. Limits secret scanning to one project per organization.
Adds a 'unique values across the whole project' validation rule to enforce that a secret value is not duplicated in any other secret within the project.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
3 more in Everything
API surface changed: +4 endpoints, 175 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
New endpoint POST /api/v1/cert-manager/syncs/certificate-orders/search︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint POST /api/v1/cert-manager/syncs/certificates/search New endpoint POST /api/v1/pki/syncs/certificate-orders/search New endpoint POST /api/v1/pki/syncs/certificates/search
4 details in Everything
Restores Oracle Database PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. ISO ISO A widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.12 https://github.com/Infisical/infisical.git
$ git checkout v0.165.12
Supports AWS US ISO and ISOB regions for external KMS key management. Adds audit log details for PKI certificate events.
2 more in Everything
Infisical v0.165.11 adds credential-free agents, Snowflake PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. X.509 X.509 A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.11 https://github.com/Infisical/infisical.git
$ git checkout v0.165.11
Adds time-unit support for secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. Adds Snowflake account support to the PAM (Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Supports custom X.509 extensions on certificate policies and profiles. Introduces agent vault: Infisical agents that run without credentials (preview). Makes the relay optional for gateways, reducing infrastructure requirements for gateway deployments.
+2 more
show less
Adds self-serve plan upgrade capability directly from the product UI. Implements a copy secrets workflow in the secrets UI, enabling bulk secret copying across environments or projects.
Adds time-unit support for secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. Adds Snowflake account support to the PAM (Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Introduces agent vault: Infisical agents that run without credentials (preview). Adds self-serve plan upgrade capability directly from the product UI. Implements a copy secrets workflow in the secrets UI, enabling bulk secret copying across environments or projects.
2 more in Everything
API surface changed: +16 endpoints, 11 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
API change API surface changed: +16 endpoints, 11 modified︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
+ DELETE /api/v1/secret-validation-rules/dynamic-secrets/{ruleId} + DELETE /api/v1/secret-validation-rules/secret-rotations/{ruleId} + DELETE /api/v1/secret-validation-rules/static-secrets/{ruleId} + GET /api/v1/secret-validation-rules + GET /api/v1/secret-validation-rules/dynamic-secrets + GET /api/v1/secret-validation-rules/dynamic-secrets/{ruleId} + GET /api/v1/secret-validation-rules/secret-rotations + GET /api/v1/secret-validation-rules/secret-rotations/{ruleId} + GET /api/v1/secret-validation-rules/static-secrets + GET /api/v1/secret-validation-rules/static-secrets/{ruleId} + PATCH /api/v1/secret-validation-rules/dynamic-secrets/{ruleId} + PATCH /api/v1/secret-validation-rules/secret-rotations/{ruleId} + PATCH /api/v1/secret-validation-rules/static-secrets/{ruleId} + POST /api/v1/secret-validation-rules/dynamic-secrets + POST /api/v1/secret-validation-rules/secret-rotations + POST /api/v1/secret-validation-rules/static-secrets
~ GET /api/v3/gateways/{gatewayId}: response schema changed ~ PATCH /api/v1/additional-privilege/identity: request body changed ~ PATCH /api/v1/workspace/{workspaceId}: request body changed ~ PATCH /api/v3/gateways/{gatewayId}: response schema changed ~ POST /api/v1/additional-privilege/identity/permanent: request body changed ~ POST /api/v1/additional-privilege/identity/temporary: request body changed ~ POST /api/v1/cert-manager/certificates/import-certificate: request body changed; response schema changed ~ POST /api/v1/project-templates: request body changed ~ POST /api/v1/projects: request body changed ~ POST /api/v2/workspace: request body changed ~ POST /api/v3/gateways: response schema changed
New endpoint DELETE /api/v1/secret-validation-rules/dynamic-secrets/{ruleId}︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ New endpoint DELETE /api/v1/secret-validation-rules/secret-rotations/{ruleId} New endpoint DELETE /api/v1/secret-validation-rules/static-secrets/{ruleId} New endpoint GET /api/v1/secret-validation-rules New endpoint GET /api/v1/secret-validation-rules/dynamic-secrets
+11 more
show less
New endpoint GET /api/v1/secret-validation-rules/dynamic-secrets/{ruleId} New endpoint GET /api/v1/secret-validation-rules/secret-rotations New endpoint GET /api/v1/secret-validation-rules/secret-rotations/{ruleId} New endpoint GET /api/v1/secret-validation-rules/static-secrets New endpoint GET /api/v1/secret-validation-rules/static-secrets/{ruleId} New endpoint PATCH /api/v1/secret-validation-rules/dynamic-secrets/{ruleId} New endpoint PATCH /api/v1/secret-validation-rules/secret-rotations/{ruleId} New endpoint PATCH /api/v1/secret-validation-rules/static-secrets/{ruleId} New endpoint POST /api/v1/secret-validation-rules/dynamic-secrets New endpoint POST /api/v1/secret-validation-rules/secret-rotations New endpoint POST /api/v1/secret-validation-rules/static-secrets
16 details in Everything
Infisical v0.165.10 adds validation rule API revamp, certificate profile attachment for imported certs, and folder creation in vault migration.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.10 https://github.com/Infisical/infisical.git
$ git checkout v0.165.10
Revamps the validation rule API, enabling updated programmatic control over secret validation rules.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Supports attaching a certificate profile to imported certificates in PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Adds folder creation support to the vault migration feature, allowing secrets to be migrated into a structured folder hierarchy.
Revamps the validation rule API, enabling updated programmatic control over secret validation rules.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Supports attaching a certificate profile to imported certificates in PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
1 more in Everything
Infisical v0.165.9 adds a global command menu, INFISICAL_RUN_MODES env var, Daytona duplicate-sync detection, and PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.9 https://github.com/Infisical/infisical.git
$ git checkout v0.165.9
Introduces INFISICAL_RUN_MODES environment variable to control which operational modes the Infisical server runs in.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds a global command menu to the UI for fast keyboard-driven navigation across the platform. Adds PKI license gating to enforce feature access based on license tier.
3 details in Everything
Infisical v0.165.7 adds break-glass emergency access for PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.7 https://github.com/Infisical/infisical.git
$ git checkout v0.165.7
Adds break-glass emergency access capability for PAM access requests, enabling out-of-band approval bypass in critical situations. Allows a single LDAP connection to back multiple Linux and Windows syncs simultaneously, reducing connection overhead for directory-integrated environments.
Adds break-glass emergency access capability for PAM access requests, enabling out-of-band approval bypass in critical situations.
1 more in Everything
API surface changed: +17 endpoints, 31 modified
API change API surface changed: +17 endpoints, 31 modified
+ DELETE /api/v1/app-connections/daytona/{connectionId} + DELETE /api/v1/secret-syncs/daytona/{syncId} + GET /api/v1/app-connections/daytona + GET /api/v1/app-connections/daytona/available + GET /api/v1/app-connections/daytona/connection-name/{connectionName} + GET /api/v1/app-connections/daytona/{connectionId} + GET /api/v1/secret-syncs/daytona + GET /api/v1/secret-syncs/daytona/sync-name/{syncName} + GET /api/v1/secret-syncs/daytona/{syncId} + PATCH /api/v1/app-connections/daytona/{connectionId} + PATCH /api/v1/secret-syncs/daytona/{syncId} + POST /api/v1/app-connections/daytona + POST /api/v1/app-connections/daytona/{connectionId}/rotate-credentials + POST /api/v1/secret-syncs/daytona + POST /api/v1/secret-syncs/daytona/{syncId}/import-secrets + POST /api/v1/secret-syncs/daytona/{syncId}/remove-secrets + POST /api/v1/secret-syncs/daytona/{syncId}/sync-secrets
~ DELETE /api/v1/auth/oidc-auth/identities/{identityId}: response schema changed ~ DELETE /api/v1/cert-manager/syncs/linux-server/{pkiSyncId}: response schema changed ~ DELETE /api/v1/cert-manager/syncs/windows-server/{pkiSyncId}: response schema changed ~ DELETE /api/v1/pki/syncs/linux-server/{pkiSyncId}: response schema changed ~ DELETE /api/v1/pki/syncs/windows-server/{pkiSyncId}: response schema changed ~ GET /api/v1/auth/oidc-auth/identities/{identityId}: response schema changed ~ GET /api/v1/cert-manager/syncs/linux-server: response schema changed ~ GET /api/v1/cert-manager/syncs/linux-server/{pkiSyncId}: response schema changed ~ GET /api/v1/cert-manager/syncs/options: response schema changed ~ GET /api/v1/cert-manager/syncs/windows-server: response schema changed ~ GET /api/v1/cert-manager/syncs/windows-server/{pkiSyncId}: response schema changed ~ GET /api/v1/pki/syncs/linux-server: response schema changed ~ GET /api/v1/pki/syncs/linux-server/{pkiSyncId}: response schema changed ~ GET /api/v1/pki/syncs/options: response schema changed ~ GET /api/v1/pki/syncs/windows-server: response schema changed ~ GET /api/v1/pki/syncs/windows-server/{pkiSyncId}: response schema changed ~ PATCH /api/v1/auth/oidc-auth/identities/{identityId}: request body changed; response schema changed ~ PATCH /api/v1/cert-manager/syncs/linux-server/{pkiSyncId}: request body changed; response schema changed ~ PATCH /api/v1/cert-manager/syncs/windows-server/{pkiSyncId}: request body changed; response schema changed ~ PATCH /api/v1/identity-templates/{templateId}: request body changed ~ PATCH /api/v1/pki/syncs/linux-server/{pkiSyncId}: request body changed; response schema changed ~ PATCH /api/v1/pki/syncs/windows-server/{pkiSyncId}: request body changed; response schema changed ~ POST /api/v1/auth/oidc-auth/identities/{identityId}: request body changed; response schema changed ~ POST /api/v1/cert-manager/syncs/linux-server: request body changed; response schema changed ~ POST /api/v1/cert-manager/syncs/linux-server/test-health-check: request body changed ~ POST /api/v1/cert-manager/syncs/windows-server: request body changed; response schema changed ~ POST /api/v1/cert-manager/syncs/windows-server/test-health-check: request body changed ~ POST /api/v1/pki/syncs/linux-server: request body changed; response schema changed ~ POST /api/v1/pki/syncs/linux-server/test-health-check: request body changed ~ POST /api/v1/pki/syncs/windows-server: request body changed; response schema changed ~ POST /api/v1/pki/syncs/windows-server/test-health-check: request body changed
Adds Daytona app-connection APIs for availability and name lookup, lifecycle management, and credential rotation. Adds Daytona secret-sync APIs for name lookup, lifecycle management, and importing, removing, or synchronizing secrets. Updates request or response schemas across OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Updates request or response schemas across Linux and Windows Certificate Manager and PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Updates the request body for PATCH /api/v1/identity-templates/{templateId}.
5 details in Everything
Adds region configuration for license server communication
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.5 https://github.com/Infisical/infisical.git
$ git checkout v0.165.5
region field added to license client config to specify the target data center
1 detail in Everything
Infisical v0.165.3 adds Daytona secret sync, OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.3 https://github.com/Infisical/infisical.git
$ git checkout v0.165.3
└──▷ HOW TO FIND IT
Configure a Daytona secret sync so secrets from an Infisical project environment are pushed to your Daytona workspace.
📍 In the Infisical console, go to your Project › Integrations › Secret Syncs, click Add Sync , select Daytona , configure the Daytona app connection, choose the source environment and path, then save.
Adds Daytona app connection and secret sync integration, enabling secrets stored in Infisical to be synced to Daytona environments. Adds OIDC auth template support for Machine Identities, allowing reusable OIDC authentication configurations across MIs. Adds PAM account password viewing gated behind access requests, so privileged account credentials require an approval workflow before being revealed. Adds PAM heartbeats to track liveness of privileged access sessions. Syncs member email and name from the identity provider identity provider A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
+2 more
show less
Removes plan-tier restriction from the policy delete endpoint, making policy deletion available regardless of subscription level. Approval UI now shows human-readable names instead of UUIDs UUIDs A universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.
7 details in Everything
infisical now publishes an API — 2300 endpoints across 67 areas: App Connections, Secret Syncs, Secret Rotations, …
App Connections (666 endpoints) — create, read, update, delete Secret Syncs (434 endpoints) — create, read, update, delete Secret Rotations (285 endpoints) — create, read, update, delete Pki Syncs (200 endpoints) — create, read, update, delete Pki Certificate Authorities (93 endpoints) — create, read, update, delete
+4 more
show less
Pki Applications (37 endpoints) — create, read, update, delete Secret Scanning (37 endpoints) — create, read, update, delete Pki Signers (34 endpoints) — create, read, update, delete 59 more areas: Pki Certificates, Folders, Secrets, Api, Groups, Pki Certificate Profiles, Pki Certificate Templates, Project Groups, Integrations, Project Identities, Identities, Pki Acme, Project Users, Projects, Secret Imports, Universal Auth, Dynamic Secrets, Environments, Pki Subscribers, Project Roles, Kms Keys, Pki Alerting, Pki Certificate Collections, Pki Discovery, Token Auth, Hsm Connectors, Identity Specific Privileges, Identity Specific Privileges V2, Kms Signing, Ldap Auth, Organization Roles, Organizations, Proxied Services, Spiffe Auth, Aws Auth, Alibaba Cloud Auth, Azure Auth, Gcp Auth, Jwt Auth, Kubernetes Auth, Oci Auth, Oidc Auth, Pki Certificate Policies, Project Templates, Secret Sharing, Sub Organizations, Tls Certificate Auth, Gateways, Pki Installations, Ldap Sso, Oidc Sso, Project Identity Membership, Saml Sso, Kms Encryption, Scim, Audit Logs, Event Subscriptions, Organization Identity Membership, Service Tokens
9 details in Everything
Infisical v0.165.1 adds folder RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.1 https://github.com/Infisical/infisical.git
$ git checkout v0.165.1
Adds GCP Certificate Manager Sync for PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Adds folder RBAC, allowing role-based access control role-based access control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Adds webhook events for approval and change request workflows, enabling external systems to react to secret approval lifecycle events. Adds Kubernetes Managed Identity (MI) auth template support for machine identity authentication. Adds trim suffix function to ABAC ABAC Attribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. attribute-based access control attribute-based access control Attribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status.
+8 more
show less
Adds pre-fetch commands for PKI sync agents on Windows and Linux platforms. Exposes the latest renewal of a certificate via the PKI agent so agents can detect and follow certificate renewals. Adds port number configuration to the Splunk dynamic secrets provider. Sets project-level secret retention limits. Revamps the replicate secrets workflow in the secret manager UI. Adds helper text for DigiCert profiles during certificate issuance. Defaults SSH access to an interactive shell in Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds a select all option for the Vault import secret path Combobox in the UI.
13 details in Everything
Infisical v0.165.0 adds GCP Certificate Manager sync, folder RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.165.0 https://github.com/Infisical/infisical.git
$ git checkout v0.165.0
feat(permissions) : introduce folder-level RBAC to manage secret access control per directory.feat(webhooks) : emit webhook events for approval and change request lifecycle states.Set project_retention_limits to enforce expiration policies for projects.
3 details in Everything
Infisical v0.164.1 adds PostgreSQL account discovery for PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.164.1 https://github.com/Infisical/infisical.git
$ git checkout v0.164.1
Requires config.siteUrl in the infisical-nkp Helm chart configuration. Adds PostgreSQL account discovery for Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds load balancing support for gateway pools. Migrates identity and access provider forms for dynamic secrets to an updated UI. Migrates data-service and protocol provider forms for dynamic secrets to an updated UI.
5 details in Everything
Infisical v0.164.0 adds cert profile creation inside applications and root encryption key rotation.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.164.0 https://github.com/Infisical/infisical.git
$ git checkout v0.164.0
Allows creation of certificate profiles from directly inside applications, streamlining PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Implements root encryption key rotation, enabling operators to rotate the platform's root encryption key. Gates cross-project secret sharing actions by settings, giving admins finer control over which projects can share secrets.
3 details in Everything
Infisical v0.163.0 adds IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. RFC 8693 RFC 8693 An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user. token exchange token exchange An OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.163.0 https://github.com/Infisical/infisical.git
$ git checkout v0.163.0
└──▷ HOW TO FIND IT
Protect a KMS key from accidental deletion in environments where key loss would be catastrophic.
📍 In the Infisical console, go to your project › Key Management, select a key, open its settings, and enable Delete Protection .
Adds IAM authentication for Postgres in the PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds RFC 8693 token exchange grant support for OAuth/OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Adds delete protection for KMS keys, preventing accidental key removal. Extends change/approval policies to apply to machine identities, not just human users. Adds dedicated folder views for PAM secrets.
+6 more
show less
Adds project tag editing under project settings. Allows editing certificate details during manual certificate renewals. Shows renewed certificates with a Renewed status indicator in the certificate manager UI. Migrates project roles access control UI to the v3 design. Migrates dynamic secrets relational, warehouse, and managed-store provider forms to the v3 UI. Adds clock skew handling for gateway and relay connections.
11 details in Everything
Infisical v0.162.23 adds PKCS#12 PKCS#12 A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.23 https://github.com/Infisical/infisical.git
$ git checkout v0.162.23
Raises the PKI post-sync command character limit to 8192 characters, enabling longer post-sync scripts. Adds PKCS#12 keystore import support to the certificate manager.
2 details in Everything
Infisical v0.162.22 adds Kubernetes auth for gateway enrollment, code-signing approval scoping, and a secret manager insights view.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.22 https://github.com/Infisical/infisical.git
$ git checkout v0.162.22
Adds Kubernetes auth for gateway enrollment, enabling Kubernetes-native authentication when enrolling gateways. Scopes code-signing approvals to a specific signing situation, allowing more granular control over approval workflows. Adds a Secret Manager product insights view for visibility into secret manager usage and activity. Bumps infisical-nkp Helm chart to 0.2.0 with Valkey support and extraEnv configuration. Migrates machine identities access control to the v3 UI in the Access Control section.
+6 more
show less
Migrates project access control groups to v3 UI. Migrates secret rotations setup flow to v3 UI. Migrates project users access control to v3 UI. Adds deprecation banners and email notifications for native integrations being deprecated. Revamps commit history UI for improved auditability of secret changes. Uses Cloudflare's bulk update endpoint for worker secrets, improving sync performance.
11 details in Everything
Infisical v0.162.20 adds KMIP auto certificate renewal and a shared provider form for dynamic secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.20 https://github.com/Infisical/infisical.git
$ git checkout v0.162.20
Adds KMIP auto certificate renewal, reducing manual overhead for certificate lifecycle management. Adds a shared provider form contract for dynamic secrets, standardizing how dynamic secret providers are configured. Adds dismiss of selected actions via the Escape key in the UI.
3 details in Everything
Infisical v0.162.19 adds machine identity support for PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.19 https://github.com/Infisical/infisical.git
$ git checkout v0.162.19
Infisical v0.162.18 adds gateway support for Chef app connections and a new Modify Role action for project members.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.18 https://github.com/Infisical/infisical.git
$ git checkout v0.162.18
Adds gateway support to the Chef app connection, enabling Chef integrations to route through Infisical gateways. Adds a Modify Role action directly on project member role rows in the UI, allowing inline role changes without navigating away.
2 details in Everything
Infisical v0.162.17 adds Redis PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. extraArgs
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.17 https://github.com/Infisical/infisical.git
$ git checkout v0.162.17
Adds support for issuing CA certificates from AWS Private CA in the PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Adds extraArgs configuration key to the Gateway Helm chart values
2 details in Everything
Infisical v0.162.16 adds Spacelift sync, Cloudflare secret rotation, PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.16 https://github.com/Infisical/infisical.git
$ git checkout v0.162.16
Adds secret rotation support for Cloudflare API tokens and R2 access keys. Adds PKI post-sync command support for Windows and Linux agents. Adds Spacelift as a new secrets sync integration. Adds expiry alerts for machine identity authentication credentials. Enables cross-project secret sharing gated by license entitlement.
+8 more
show less
Adds staleness check for Windows PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds a dedicated 403 forbidden-access error page in the UI. Revamps the certificate manager UI. Migrates gateway and relay UI to v3. Revamps personal settings UI. Adds guided self-hosted bootstrap onboarding for admins. Expands onboarding flow with product selection and metrics. Shows organization name on invite signup screen.
13 details in Everything
Infisical v0.162.15 adds SCEP SCEP Simple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.15 https://github.com/Infisical/infisical.git
$ git checkout v0.162.15
Adds SCEP (Simple Certificate Enrollment Protocol) support for Microsoft Intune, enabling certificate-based device enrollment flows. New Helm chart (infisical-nkp) for deploying Infisical in Nutanix Kubernetes Platform (NKP) partner catalog environments. Adds connection test capability for PAM (Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Improves machine identity template visibility in the UI, making templates easier to discover and manage.
4 details in Everything
Infisical v0.162.14 adds Google Workspace service template, Windows domain account rotation, enriched secret reminder emails, and instance version update checks.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.14 https://github.com/Infisical/infisical.git
$ git checkout v0.162.14
Adds Google Workspace as a proxied service template (available as a popular template in the service proxy catalog). Tracks and displays a last-used timestamp for proxied services. Adds an instance version update check with in-UI display so self-hosted admins can see when a newer release is available. New machine identity creation sheet includes policy templates to accelerate identity provisioning. Enriches secret reminder emails with secret details and a direct View secret link.
+1 more
show less
Adds PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
6 details in Everything
Infisical v0.162.13 adds Azure auto-rotation, LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.13 https://github.com/Infisical/infisical.git
$ git checkout v0.162.13
Adds automatic credential rotation for Azure App Connections Adds manual credential rotation for LDAP connections Allows user-defined regions in the replicationPolicy for GCP secret synchronization Migrates Organization-level KMS settings to version 3 via the UI Redesigns authentication screens and enforces shared password policies across the workspace
5 details in Everything
Adds PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. ADCS ADCS Active Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.12 https://github.com/Infisical/infisical.git
$ git checkout v0.162.12
feat: add PKI sync for KEMP Loadbalancer enables syncing PKI data to KEMP Loadbalancer instances.feat(dynamic-secrets): add support for session policies on temporary credentials allows defining session policies when generating temporary credentials.feat: make certificate properties optional for ADCS CAs makes certificate properties optional when configuring ADCS CAs.
3 details in Everything
Adds Datadog and Snowflake secrets rotation support, HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. PKCS#11 PKCS#11 The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.11 https://github.com/Infisical/infisical.git
$ git checkout v0.162.11
feat(secret-rotation-app-conn) : adds Datadog API keys support for secret rotation appsfeat(secret-rotation) : adds Snowflake user key support for secret rotationfeat: supports pre-hashed RSA RSA The oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. feat(identity-tls-cert-auth) : allows optional trust-anchor chain verification for client certificates in Identity TLS cert authfeat(search) : adds metadata search capability
5 details in Everything
Infisical v0.162.10 adds Nutanix Prism Central PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. --domain CLI flag for PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.10 https://github.com/Infisical/infisical.git
$ git checkout v0.162.10
Imports now include secretPath in returned secrets
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.9 https://github.com/Infisical/infisical.git
$ git checkout v0.162.9
Added secretPath to the response payload when importing secrets
1 detail in Everything
Adds Tailscale dynamic secret integration, HMAC HMAC A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.8 https://github.com/Infisical/infisical.git
$ git checkout v0.162.8
Add Tailscale dynamic secret integration introduces a new built-in dynamic secret engine for provisioning Tailscale credentials on-demand.HMAC keys in KMS adds support for HMAC key types when configuring Key Management Service Key Management Service A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. Supports Unix discovery for PAM (Platform Access Management), allowing the system to automatically detect and manage Unix-based targets for access control. Introduces a personal override action on the secrets resource for roles, permitting individual users to bypass standard role restrictions on specific secrets.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Default roles for agent and agent-proxy have been removed; custom role assignments are now required for these agents to function.
Infisical v0.162.7 adds Windows and Linux PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.7 https://github.com/Infisical/infisical.git
$ git checkout v0.162.7
Add region config option for global scope in GCP sync to specify target cloud region Allow multiple projects to be selected in project grants for broader access control Add Windows and Linux servers PKI sync capability to distribute certificates automatically Implement secrets brokering with proxied services and agent proxy CA for secure credential injection Automatically add org-admins to PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
5 details in Everything
Adds metrics for secrets to monitor secret management activity.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.6 https://github.com/Infisical/infisical.git
$ git checkout v0.162.6
Adds metrics for secrets to expose monitoring data.
1 detail in Everything
Infisical v0.162.4 adds a secrets activation modal and expands framework and infrastructure integration coverage.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.4 https://github.com/Infisical/infisical.git
$ git checkout v0.162.4
Adds an activation modal for secrets management workflows. Revamps and expands framework integrations and infrastructure integrations coverage.
2 details in Everything
Infisical v0.162.3 adds certificate upload, Azure CLI PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.3 https://github.com/Infisical/infisical.git
$ git checkout v0.162.3
Supports JSON and plain text variable formats in Cloudflare Workers sync Adds Azure CLI access to Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds Slack notifications for access approvals Supports certificate upload Makes the certificate authority get-cert endpoint publicly accessible
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The PAM assumer role has been removed
Infisical v0.162.2 revamps Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.2 https://github.com/Infisical/infisical.git
$ git checkout v0.162.2
Infisical v0.162.0 adds Rundeck support for secret sync and revamps the PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.162.0 https://github.com/Infisical/infisical.git
$ git checkout v0.162.0
Adds Rundeck as a supported app connection for secret sync. Revamped PAM user experience.
2 details in Everything
Infisical v0.161.14 adds native Windows ADCS ADCS Active Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.14 https://github.com/Infisical/infisical.git
$ git checkout v0.161.14
Adds native Windows Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Improves metering UI to surface more usage information for users.
2 details in Everything
Infisical v0.161.13 adds HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.13 https://github.com/Infisical/infisical.git
$ git checkout v0.161.13
Exposes certificate sync external identifier in the API and UI, making it easier to correlate Infisical-managed certs with external systems. Adds HSM-backed internal certificate authorities, enabling hardware-protected signing for internally issued certificates. Supports Hasura Cloud as a secret sync destination, pushing secrets directly to Hasura Cloud environments. Enables cross-project secret sharing, allowing secrets to be shared across different Infisical projects.
4 details in Everything
Infisical v0.161.12 adds cross-project secret sharing capability
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.12 https://github.com/Infisical/infisical.git
$ git checkout v0.161.12
Infisical v0.161.11 adds Sumo Logic audit streams, Windows AD and AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.11 https://github.com/Infisical/infisical.git
$ git checkout v0.161.11
Add Sumo Logic as an audit log stream provider to forward audit events. Assign project roles when creating identities to grant immediate access upon onboarding. Add Windows AD account type with multi-host selection for PAM secret management. Add AWS IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Add machine identity support to PAM for automated service-to-service secret sharing.
+4 more
show less
Introduce Audit Reports feature to generate summarized audit history exports. Add Cloud 66 secret sync app connection for automated secret distribution to hosted apps. Add Qovery support to the secret sync app connection catalog for platform integration. Add DigiCert code-sign support for certificate management workflows.
9 details in Everything
Exposes public CA certificate URL in UI for easier certificate management.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.10 https://github.com/Infisical/infisical.git
$ git checkout v0.161.10
Adds public CA certificate URL display in the Infisical UI
1 detail in Everything
Adds MongoDB and MS SQL account types, MySQL web explorer, MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.9 https://github.com/Infisical/infisical.git
$ git checkout v0.161.9
Add mongodb and mssql_server account types to PAM Add GET /api/v2/project/{projectId}/environment/slug/:envSlug endpoint to get project environment by environment slug Add MySQL web access data explorer to PAM Implement MFA access flow for accounts in PAM Add command blocking and session log masking support to PAM
+1 more
show less
Add Windows RDP support and S3 recording overrides to PAM
6 details in Everything
Adds application membership API endpoints and database constraints for folder secret key uniqueness.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.8 https://github.com/Infisical/infisical.git
$ git checkout v0.161.8
Adds application membership API endpoints to manage application-level access.
1 detail in Everything
New PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.6 https://github.com/Infisical/infisical.git
$ git checkout v0.161.6
└──▷ TRY IT
Look up a user's specific membership status within a project via the API.
copy
$ curl -H "Authorization: Bearer <token>" https://app.infisical.com/api/member?projectId=<project_id>&userId=<user_id> Sync secrets from a Trigger.dev application connection to Infisical.
📍 # Configure in the UI under Integrations › Trigger.dev
GET /api/member endpoint added to retrieve membership by project id and user idAdds Trigger.dev app connection and secret sync integration Adds registry-driven template policies for PAM (Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds new MongoDB and MS SQL Server account types to the PAM catalog Adds HSM connector support for PKI code signing workflows
5 details in Everything
Allow user invitations when SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.5 https://github.com/Infisical/infisical.git
$ git checkout v0.161.5
Add allow_user_invitations toggle to permit local account invites even with SSO enforced
1 detail in Everything
Adds steps for FQDN support in PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.4 https://github.com/Infisical/infisical.git
$ git checkout v0.161.4
└──▷ HOW TO FIND IT
Configure PKI syncs to use FQDNs instead of IP addresses.
📍 Steps: In the PKI Sync configuration, enter the Fully Qualified Domain Name (FQDN) as the target hostname for the secret reference.
Filter audit logs to only show events for a specific product.
📍 Steps: Navigate to Audit Log › Streaming and apply the Product filter to isolate events from a specific service or component.
Adds Full Qualified Domain Name (FQDN) support to PKI Syncs schemas. Allows filtering audit log streaming by product.
2 details in Everything
Adds a project role lookup endpoint, MySQL account support, and dual-read entitlements in v0.161.3
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.3 https://github.com/Infisical/infisical.git
$ git checkout v0.161.3
└──▷ HOW TO FIND IT
Configure a MySQL connection for secrets integration
📍 In the console, go to Integrations › New Integration › MySQL and enter your credentials
Adds MySQL account support for secret management Implements dual-read v1/v2 entitlements with discrepancy logging
2 details in Everything
Infisical v0.161.2 adds PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.2 https://github.com/Infisical/infisical.git
$ git checkout v0.161.2
Adds PAM sessions, audit logs, and access control pages to the UI Adds CLI support for Postgres databases Adds KMS key rotation capability Adds move operation for folders
4 details in Everything
Adds unexportable flag for KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.1 https://github.com/Infisical/infisical.git
$ git checkout v0.161.1
Add unexportable flag to KMS keys to prevent key material export Add webhook type for triggered honey tokens Add support for revoking certificates using thumbprints Add handlebar templates for permissions Add new template function for Kubernetes operator
5 details in Everything
Adds KMIP CSR CSR A Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.161.0 https://github.com/Infisical/infisical.git
$ git checkout v0.161.0
Add KMIP client CSR signing for generating Certificate Signing Requests via the Key Management Interoperability Protocol.Support dynamic secrets and rotations within validation rules, enabling automated lifecycle management during validation. Detect duplicate secret values in the secrets insight feature to surface redundant or copy-pasted credentials. Support Convex secret rotation to automate credential updates for Convex database connections. Allow multiple GitHub apps per organization to expand integration options for repository access.
+1 more
show less
Enable gateway support for Azure Key Vault connections.
6 details in Everything
Adds async project deletion, IBM API Connect dynamic secrets, and GoDaddy CA integration to Certificate Manager.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.11 https://github.com/Infisical/infisical.git
$ git checkout v0.160.11
Implement async project deletion via soft-delete and paced hard-delete worker Integrate GoDaddy CA with Certificate Manager for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Complete support for external KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Remove gateway v1 (https://github.com/Infisical/infisical/pull/6725)
Infisical v0.160.10 adds NTLM NTLM A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. OTEL OTEL An open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.10 https://github.com/Infisical/infisical.git
$ git checkout v0.160.10
└──▷ HOW TO FIND IT
Search the certificate inventory by metadata fields like subject or issuer.
📍 In the Inventory UI, use the new certificate metadata search field to filter certificates.
Add NTLM and Kerberos auth support for MSSQL enables Windows-authenticated database connections in InfisicalAdd certificate metadata search to inventory UI allows filtering certificates by fields in the certificate inventory screenSeed pre-defined PKI certificate policies at org creation automatically applies PKI policies when a new organization is createdExpand OTEL metrics coverage with bounded-cardinality InfisicalCore meter for observability
4 details in Everything
Infisical v0.160.8 adds enforceIdentityLimit flag, post-quantum post-quantum Cryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. ML-DSA ML-DSA NIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.8 https://github.com/Infisical/infisical.git
$ git checkout v0.160.8
enforceIdentityLimit flag enforces identity limits regardless of planSupport for DigiCert revocation status in PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Post-quantum ML-DSA signing algorithms added to KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. Soft delete capability for environments introduced Blind index support added for secret values enabling new search patterns
+2 more
show less
External emails now included on audit log for secret-share actions Machine identities from both org and project displayed at org level
7 details in Everything
Infisical v0.160.7 adds pending cert request cancellation and project-scoped External ID for AWS Assume Role.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.7 https://github.com/Infisical/infisical.git
$ git checkout v0.160.7
Adds the ability to cancel pending certificate requests with improved visibility into their issuance status Uses a project-scoped External ID for AWS Assume Role connections to improve credential isolation
2 details in Everything
Infisical v0.160.6 adds DISABLE_PUBLIC_SECRET_SHARING env var and webhook body improvements
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.6 https://github.com/Infisical/infisical.git
$ git checkout v0.160.6
└──▷ USE IT
Disable public secret sharing across your self-hosted Infisical instance by setting this environment variable.
shell
copy
export DISABLE_PUBLIC_SECRET_SHARING=true
Adds DISABLE_PUBLIC_SECRET_SHARING environment variable to disable public secret sharing via the admin panel Webhook payload now includes the environment_name field in the request body
2 details in Everything
mTLS mTLS Mutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.5 https://github.com/Infisical/infisical.git
$ git checkout v0.160.5
Add mutual TLS mutual TLS Mutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. Add certificate authentication for Azure Key Vault in app connections. Add resource identity authentication for relays. Allow importing a certificate without a private key or chain.
4 details in Everything
Adds Milvus dynamic-secret support, PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.4 https://github.com/Infisical/infisical.git
$ git checkout v0.160.4
milvus is a new dynamic-secret provider, enabling Infisical to rotate credentials for Milvus databasesPKI certificates generated via ACME can now use * wildcards in DNS identifiers (e.g., *.example.com) A permission audit log is now emitted for project machine identity actions, allowing tracking of who modified which identity's permissions
3 details in Everything
Adds permission audit feature to project users page
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.2 https://github.com/Infisical/infisical.git
$ git checkout v0.160.2
└──▷ HOW TO FIND IT
Review and audit permissions for users within a specific project.
📍 In the Infisical UI, navigate to a Project › Users tab and select Permission Audit .
New PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.1 https://github.com/Infisical/infisical.git
$ git checkout v0.160.1
feat(pam) : Adds a browser-based RDP client with session recording and playback capabilities for privileged access management privileged access management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. feat(pam) : Introduces bypass approvals feature, allowing specific PAM access requests to skip the standard approval workflow.feat(secrets) : Enables direct duplication of secrets between environments via a new API endpoint or UI action.
3 details in Everything
PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.160.0 https://github.com/Infisical/infisical.git
$ git checkout v0.160.0
Adds PKI applications to manage certificate identities within PKI workflows Adds organization-level overview product category tiles and a navbar type selector
2 details in Everything
Adds Oracle PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.29 https://github.com/Infisical/infisical.git
$ git checkout v0.159.29
feat(pam) : add Oracle DB access supportfeat(dynamic-secrets) : added memory db (valkey) supportfeat(backend) : add distributed cron job system with Redis-backed schedulingfeat(secret-rotation) : add rotation for datadog service accountfeat(gateway) : add enrollment flow support to Helm chart and re-add Kubernetes docs
+2 more
show less
feat(pam-rdp) : browser RDP session replay playerfeat: create audit log for honey token triggers
7 details in Everything
Adds UI announcement banners and request-access project actions
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.28 https://github.com/Infisical/infisical.git
$ git checkout v0.159.28
└──▷ HOW TO FIND IT
Check how the new announcement feature renders in the interface
📍 In the web console, view the top banner area where announcements are displayed.
Adds UI announcements for cloud and self-hosted instances via a new banner component
1 detail in Everything
Adds RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.27 https://github.com/Infisical/infisical.git
$ git checkout v0.159.27
Adds RDP access support for Active Directory domain accounts in the privileged access management privileged access management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds export functionality and cell scroll capability to the PostgreSQL web database access interface
2 details in Everything
Infisical v0.159.25 adds custom CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.25 https://github.com/Infisical/infisical.git
$ git checkout v0.159.25
Adds custom CRL distribution points in PKI CA configuration to control certificate revocation list sources Supports syncing secrets to Vercel teams with all custom environments
2 details in Everything
Infisical v0.159.23 adds Venafi TPP integration, Supabase secret rotation, gateway pools for HA failover, and SMTP_HELO_HOST config.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.23 https://github.com/Infisical/infisical.git
$ git checkout v0.159.23
SMTP_HELO_HOST environment variable sets the EHLO/HELO hostname used in outbound SMTP SMTP The application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. User-controlled SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Gateway pools feature enables high-availability failover configurations. Supports Venafi TPP as an external Certificate Authority integration. secret-rotation feature adds support for Supabase databases.
+1 more
show less
Audit log gains filtering capability to narrow down recorded events.
6 details in Everything
Adds Gitpod secret synchronization to infisical cyber tooling.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.22 https://github.com/Infisical/infisical.git
$ git checkout v0.159.22
feat(secret-sync) : add support for gitpod
1 detail in Everything
Infisical v0.159.20 adds bulk KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.20 https://github.com/Infisical/infisical.git
$ git checkout v0.159.20
feat(kms) : Enables bulk exporting of private keys from the Key Management System.feat(pam) : Adds a reason field to PAM account access workflows for auditing.PAM AWS credentials are now displayed directly in the CLI output for instant access. feat(sync-secret) : Adds App Connection and Secret Sync support for Travis CI integrations.feat(ca) : Supports DigiCert CertCentral as an External Certificate Authority provider.
5 details in Everything
Adds AWS ACM Public CA integration for Pki; shows systemd CLI in gateway re-enroll modal
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.19 https://github.com/Infisical/infisical.git
$ git checkout v0.159.19
└──▷ HOW TO FIND IT
Re-enroll a gateway using the provided systemd command directly from the UI modal.
📍 In the Infisical dashboard, navigate to the gateway settings and click re-enroll to view and copy the systemd CLI command.
Adds AWS ACM Public CA support to the PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Shows the systemd CLI command directly in the re-enroll gateway modal (frontend). Removes secret rotation v1, deprecating the legacy rotation mechanism.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Secret rotation v1 is removed; existing setups using the v1 rotation flow must migrate to v2.
New Vercel sync integration in v0.159.18.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.18 https://github.com/Infisical/infisical.git
$ git checkout v0.159.18
feat: adds new Vercel sync feature
1 detail in Everything
Adds in-platform migration from Doppler with a unified external migrations UI.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.17 https://github.com/Infisical/infisical.git
$ git checkout v0.159.17
Improvement: add ghost accordion variant, accordion stories
1 detail in Everything
Infisical v0.159.16 adds Kubernetes gateway auth for PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.16 https://github.com/Infisical/infisical.git
$ git checkout v0.159.16
Adds feat(pam): gateway auth for kubernetes to enable Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds webhook edit capability and granular event selection in feature(webhook) so users can filter which events trigger webhooks. Introduces project permission caching (feature(cache) ) to improve performance for project-level permission checks.
3 details in Everything
Redesigned date range picker for audit logs
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.15 https://github.com/Infisical/infisical.git
$ git checkout v0.159.15
Adds insights page for secrets management and bulk tag modal to overview; dynamic challenges support in SCEP SCEP Simple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.14 https://github.com/Infisical/infisical.git
$ git checkout v0.159.14
feat adds an insights page to the secrets management product type.feat adds dynamic challenges to SCEP.
2 details in Everything
Adds account policies for PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.13 https://github.com/Infisical/infisical.git
$ git checkout v0.159.13
Adds Post-Quantum Post-Quantum Cryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.12 https://github.com/Infisical/infisical.git
$ git checkout v0.159.12
Add Post-Quantum Crypto algorithms to PKI certificate profile creation Add support for Microsoft Teams in workflow integrations Add revoke functionality for access approvals
3 details in Everything
Infisical v0.159.10 adds AI session insights, SQL runner, JSON API for SSH CA keys, and real-time PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.10 https://github.com/Infisical/infisical.git
$ git checkout v0.159.10
└──▷ HOW TO FIND IT
Query privileged access manager data directly using the built-in SQL runner in the Data Explorer UI.
📍 In the sidebar, go to Data Explorer › SQL Runner and enter your query (e.g., SELECT * FROM sessions)
feat(pam): ai session insights — enables AI-powered analysis of privileged access manager sessionsfeat(pam): add SQL runner in data explorer — provides an interactive SQL query interface within the Data Explorer UIimprovement(dynamic-secrets): add JSON API for SSH CA public key — exposes the SSH CA public key via a new JSON endpointfeat(pam): real-time session log sync via incremental batch uploads — introduces real-time synchronization of PAM session logs using incremental batches
4 details in Everything
Infisical v0.159.9 adds NetScaler PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.9 https://github.com/Infisical/infisical.git
$ git checkout v0.159.9
PAM permissions now support resourceType as a condition when filtering resources and accounts
1 detail in Everything
v0.159.8 enables full PostHog telemetry and adds password generator validation rules
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.8 https://github.com/Infisical/infisical.git
$ git checkout v0.159.8
Enables full PostHog telemetry for all instance types, sending usage data previously withheld. Adds validation rules to the password generator secret feature, allowing stricter complexity constraints.
2 details in Everything
Adds sub-org project capability to grant secret access to root org with valid permissions
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.7 https://github.com/Infisical/infisical.git
$ git checkout v0.159.7
New SSH certificate provider for dynamic secrets and webhook trigger on secret changes
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.6 https://github.com/Infisical/infisical.git
$ git checkout v0.159.6
Adds ssh as a supported provider in the dynamic-secrets feature to issue short-lived certificates.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! Custom roles are enforced to Enterprise plans only starting June 1, 2026; creation of new roles for Pro users will be blocked.
Adds SSH PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.5 https://github.com/Infisical/infisical.git
$ git checkout v0.159.5
Adds feat: ssh pam exec and sftp capability allowing SSH users to execute commands or use SFTP SFTP SSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. Adds feat(pam): support terminating active sessions for managing PAM-backed sessions.
2 details in Everything
Secret sharing now supports magic number validation; PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.4 https://github.com/Infisical/infisical.git
$ git checkout v0.159.4
Adds magic number validation support to secret sharing Adds posthog events for PAM endpoints Re-vamps secret access insights sheet with expanded capabilities
3 details in Everything
Adds personal overrides support for secret imports
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.3 https://github.com/Infisical/infisical.git
$ git checkout v0.159.3
Infisical v0.159.2 adds SCEP SCEP Simple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.2 https://github.com/Infisical/infisical.git
$ git checkout v0.159.2
Adds SCEP enrollment method for PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Adds support for webhook triggers on secret rotations in the UI Adds an in-browser data explorer for Postgres databases within the PAM module
3 details in Everything
Infisical v0.159.0 adds PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.159.0 https://github.com/Infisical/infisical.git
$ git checkout v0.159.0
request_expiration_time on access approval policies to control how long an approval request remains valid before expiring automaticallyNew PKI alert types for certificate lifecycle events (CA revocation, intermediate cert expiry, CA/intermediate expiry) Manual gateway health check trigger in the UI to diagnose remote gateway connectivity on demand
3 details in Everything
Infisical v0.158.22 adds Microsoft SQL Server (MSSQL) as a PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.22 https://github.com/Infisical/infisical.git
$ git checkout v0.158.22
Infisical v0.158.21 adds custom roles in org invites, IP SANs for ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.21 https://github.com/Infisical/infisical.git
$ git checkout v0.158.21
└──▷ HOW TO FIND IT
Create an organization invitation with specific custom roles instead of relying on default permissions.
📍 In the UI, navigate to Organization Settings › Members and use the invite flow to select Custom Role during the invitation process.
Generate a certificate via ACME that includes internal IP addresses as valid SANs.
📍 When requesting an ACME certificate, ensure the CSR or extension requests include IP:<address> entries in the Subject Alternative Name field.
Adds support for selecting custom roles during the organization invite flow instead of forcing a single default role Adds IP address Subject Alternative Name (SAN) support to ACME certificate issuance for PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Adds an actor_id filter field to audit logs queries
3 details in Everything
Infisical v0.158.20 adds Infisical-to-Infisical secret sync and automated PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.20 https://github.com/Infisical/infisical.git
$ git checkout v0.158.20
Adds feat(secret-sync) enabling direct Infisical-to-Infisical secret synchronization between instances Adds feat(pki) for automated intermediate CA signing and auto-renewal using Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
2 details in Everything
Infisical v0.158.19 adds HP iLO password rotation and RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.19 https://github.com/Infisical/infisical.git
$ git checkout v0.158.19
secret-rotation now supports HP iLO local account password rotation, enabling automated credential refresh for HPE Integrated Lights-Out hardware.PKI certificate metadata management gains new RBAC policy conditions, allowing role-based access control role-based access control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
2 details in Everything
Infisical v0.158.18 adds PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. WinRM WinRM A Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.18 https://github.com/Infisical/infisical.git
$ git checkout v0.158.18
Adds feat: code-signing support to the PKI module for signing artifacts Enables pam-discovery on Windows local accounts with dependency detection via WinRM protocol
2 details in Everything
Infisical v0.158.17 adds Redis web access in PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.17 https://github.com/Infisical/infisical.git
$ git checkout v0.158.17
Adds redis web access capability in the Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Adds audit log visibility for created/updated/deleted secrets during AWS synchronization Increases the maximum Service Principal ID (SPID) length allowed for Azure authentication
3 details in Everything
Infisical v0.158.16 enhances identity permissions with UI updates for access control management.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.16 https://github.com/Infisical/infisical.git
$ git checkout v0.158.16
feat: enhance identity permissions — Updates the backend logic for how identities are granted permissions.
1 detail in Everything
Adds Contains All ($all) operator support to permissions
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.15 https://github.com/Infisical/infisical.git
$ git checkout v0.158.15
Infisical v0.158.14 adds CA CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.14 https://github.com/Infisical/infisical.git
$ git checkout v0.158.14
Adds an automated job to rebuild Certificate Authority (CA) Certificate Revocation Lists (CRL). Enables credential rotation for application connections. Adds support for relative import of secret references. Syncs Azure SCIM token secrets and establishes application connections for Azure SCIM. Adds audit log token metadata to track machine identity actions.
+2 more
show less
Supports Venafi as an external signature provider in the reworked CA intermediate flow. Enables auto-tidy functionality for expired certificates.
7 details in Everything
└──▷ BREAKING ON UPGRADE
! The Helm chart release method switches to OCI OCI Open Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. ! OIDC re-auth redirect is skipped if the user is already authenticated via OIDC.
Infisical v0.158.13 adds the ability to bypass SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.13 https://github.com/Infisical/infisical.git
$ git checkout v0.158.13
Adds bypass action for SSO enforcement in permissions Logs Infisical version on startup via new log entry
2 details in Everything
Adds SPIFFE SPIFFE An open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.12 https://github.com/Infisical/infisical.git
$ git checkout v0.158.12
Adds PostHog event tracking for approval workflow events.
1 detail in Everything
Adds PostHog event tracking for secret sync create and delete operations
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.11 https://github.com/Infisical/infisical.git
$ git checkout v0.158.11
Adds PostHog event tracking for dynamic secrets and a Redis stream log aggregator.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.10 https://github.com/Infisical/infisical.git
$ git checkout v0.158.10
feat: added redis stream based log aggregator
1 detail in Everything
Adds extraEnv support to the Infisical Helm chart for custom environment variable injection.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.9 https://github.com/Infisical/infisical.git
$ git checkout v0.158.9
└──▷ USE IT
Inject custom environment variables into your Infisical deployment via the Helm chart.
text
copy
extraEnv:
- name: CUSTOM_VAR
value: "my_value"
Infisical v0.158.8 adds HashiVault import, ClickHouse dynamic secret provider, and PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.8 https://github.com/Infisical/infisical.git
$ git checkout v0.158.8
Adds a new clickhouse dynamic secret provider type for generating credentials on-demand. Adds hashicorp-vault import capability to migrate secrets from HashiCorp Vault into Infisical via the secrets overview page. Adds SSH web access support within PAM resources, allowing users to establish SSH sessions directly through the browser. Adds metadata-based RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
4 details in Everything
Adds auto KMIP setup for orgs, wildcard/regex kube auth, sub-org login selection, secrets navigation in reference tree, and PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.7 https://github.com/Infisical/infisical.git
$ git checkout v0.158.7
add wildcard and regex support for kube auth implement sub-organization login selection add navigation to secrets from reference tree add metadata support to certificate and certificate requests including searching
4 details in Everything
Infisical v0.158.6 allows creating environments and importing secrets directly from the project overview page.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.6 https://github.com/Infisical/infisical.git
$ git checkout v0.158.6
└──▷ HOW TO FIND IT
Create a new environment without navigating away from the project home screen.
📍 Navigate to the Infisical overview page and use the new Add Environment option.
Import existing secrets directly into a project from the overview interface.
📍 Navigate to the Infisical overview page and use the new Secret Import option.
feat(frontend) : add support for adding environments on the overview pagefeature: add secret import support to overview page
2 details in Everything
New org/suborg membership API, Azure DNS ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.5 https://github.com/Infisical/infisical.git
$ git checkout v0.158.5
Adds a new membership API for organization and suborganization groups Adds Azure DNS as a provider for ACME Adds AWS PCA external Certificate Authority (CA) integration for PKI Expands certificate profile defaults beyond TTL TTL Time to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.
4 details in Everything
Infisical v0.158.3 adds PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.3 https://github.com/Infisical/infisical.git
$ git checkout v0.158.3
feat(pam): add web launcher for browser-based terminal access to PostgreSQL accounts enables in-browser web access terminals for PAM postgres accountsfeat(pam): windows server adds Windows Server as a supported resource type for Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. feat(pam): ad server resource & account adds Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. feat(secret-sync): support for vault KV engine v1 allows secret synchronization from HashiCorp Vault Key-Value engine version 1feat(overview): add commit history access to overview page introduces commit history browsing directly within the environment overview interface
+4 more
show less
Adds pagerduty channel to PKI alerting configurations for certificate lifecycle notifications feat(flyio): support automatic redeployment on Fly.io after secret change enables seamless secret propagation in Fly.io deploymentsConfigures sending of audit logs to ClickHouse via new API settings for high-performance log ingestion Introduces PKI Network Discovery feature to automatically detect and catalog PKI assets across the infrastructure
9 details in Everything
Adds secret reference dependency tracking to infisical
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.2 https://github.com/Infisical/infisical.git
$ git checkout v0.158.2
Infisical v0.158.1 adds PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.1 https://github.com/Infisical/infisical.git
$ git checkout v0.158.1
feat(pki): add slack webhook to alertsfeature: add PKI Cloudflare Syncfeature: add AWS load balancer PKI syncfeat: dbt app connection & service token secret rotationaccess insights added to the overview page
+1 more
show less
automatic reference updates for moved/updated secrets
6 details in Everything
Infisical v0.158 adds PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. TTL TTL Time to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. OpenRouter OpenRouter A unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.158.0 https://github.com/Infisical/infisical.git
$ git checkout v0.158.0
defaultTtl setting on certificate profiles in the UI to set default certificate validity periodsCertificate details page viewable from the PKI UI for inspecting issued certificates --suborganization-id (parameter suborganizationSlug) on identity login API endpoints for multi-org accountscircle-ci sync integration added under Integrations for automatic secret sync to CircleCI projectsskip-eab-validation option in the ACME enrollment configuration UI to bypass External Account Binding checks
+2 more
show less
OpenRouter secret rotation target available under Secret Rotation for automated API key updates Windows Local Account secret rotation target added for credential management on Windows hosts
7 details in Everything
└──▷ BREAKING ON UPGRADE
! The API endpoint parameter suborganizationId is renamed to suborganizationSlug when logging in via identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
New PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.157.0 https://github.com/Infisical/infisical.git
$ git checkout v0.157.0
└──▷ HOW TO FIND IT
Review and approve certificate requests through the new PKI workflow interface
📍 Steps: Navigate to the Security tab, select PKI , then access Approvals to review pending certificate issuance requests.
Configure an MCP server endpoint to expose only specific tools or all available tools at once
📍 Steps: In the Agent Settings, create a new MCP server endpoint and use the Select/Deselect All control in the tool configuration panel.
Introduces PKI approval workflows to manage certificate issuance via a review process Adds gateway support for MCP servers in agent-sentinel Adds select/deselect all tools option for MCP server endpoints
3 details in Everything
Adds support for users in project templates and updates GitLab integration to use fullName.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.156.3 https://github.com/Infisical/infisical.git
$ git checkout v0.156.3
Enables assigning users directly on project-template objects to provision identity-based access upon instance creation
1 detail in Everything
Adds support for encrypted metadata on secrets
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.156.2 https://github.com/Infisical/infisical.git
$ git checkout v0.156.2
Add agent-sentinel PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.156.0 https://github.com/Infisical/infisical.git
$ git checkout v0.156.0
Adds granular PII filtering for agent-sentinel with configurable entity types Adds a approve and merge button to change requests in the frontend when conditions are met
2 details in Everything
Adds intermediate CA issuance via certificate profiles, Cassandra dynamic secrets in vault migration, and name-based RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.155.7 https://github.com/Infisical/infisical.git
$ git checkout v0.155.7
certificate_profiles now support issuing intermediate CAsvault-migration adds cassandra dynamic secret support agent-sentinel MCP endpoint RBAC now supports name conditions
3 details in Everything
Adds unix/linux password rotation capability and clarifies certificate template terminology
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.155.6 https://github.com/Infisical/infisical.git
$ git checkout v0.155.6
Introduces unix/linux password rotation functionality to manage credential lifecycles on Unix/Linux systems. Renames the internal concept certificate template to certificate policy for consistency.
2 details in Everything
Adds custom branding to secret shares and Bearer Token Bearer Token A credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.155.5 https://github.com/Infisical/infisical.git
$ git checkout v0.155.5
└──▷ HOW TO FIND IT
Allow practitioners to configure custom branding for shared secrets via the UI.
📍 In the infisical service UI, navigate to Secret Share settings and enable custom branding options.
Enable Bearer Token authentication when configuring an MCP server in agent-sentinel.
📍 In the agent-sentinel configuration for the MCP server, add bearer_token to the authentication section.
feat(secret-share): custom branding support enables custom branding on shared secrets.feat(agent-sentinel): add Bearer Token authentication support for MCP servers adds Bearer Token auth to agent-sentinel MCP server integrations.
2 details in Everything
Infisical v0.155.4 adds SSH application connections to manage remote host secrets
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.155.4 https://github.com/Infisical/infisical.git
$ git checkout v0.155.4
Adds SSH app connection support for managing credentials of remote hosts
1 detail in Everything
Adds dynamic secret username templating capability.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.155.3 https://github.com/Infisical/infisical.git
$ git checkout v0.155.3
Adds Databricks secrets rotation, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.155.2 https://github.com/Infisical/infisical.git
$ git checkout v0.155.2
feature: add secrets rotation for Databricks introduces automated secrets rotation for the Databricks integration.feat(scim): support for scim events adds support for processing incoming SCIM events.feature: add redis resource access for PAM enables Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. feat: add export support for kms keys allows exporting KMS keys.
4 details in Everything
Adds Oracle DB wallet support for self-hosted instances and PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.155.1 https://github.com/Infisical/infisical.git
$ git checkout v0.155.1
Enables use of Oracle Wallet for oracleDB connections in self-hosted Infisical installations via new configuration option. Adds a request access modal callout to the Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
2 details in Everything
Infisical v0.155.0 adds PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.155.0 https://github.com/Infisical/infisical.git
$ git checkout v0.155.0
machine identity groups feature allows grouping of machine identities for easier managementadd skip dns ownership validation option for acme cert profile to allow ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. pam findByPath function improvement enables faster lookups by path in the Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. certificate based auth for ssh feature enables SSH authentication using certificates within PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. octopus deploy app-connection + secret-sync integration adds support for syncing secrets to Octopus Deploy
+4 more
show less
expose and rename external group mappings endpoint in SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. audit logs for dynamic secrets and leases feature provides detailed logging of dynamic secret lifecycle eventssql rotation query option and password policy enforcement allows custom SQL queries for rotating credentials agentic manager feature introduces new capabilities for managing agents within the platform
9 details in Everything
└──▷ BREAKING ON UPGRADE
! removed k8s operator from main repo
Adds suborganization scope support for managing secrets across nested organizational units.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.154.6 https://github.com/Infisical/infisical.git
$ git checkout v0.154.6
feature: suborg scope support enables targeting secret management operations to specific suborganizations within a broader organization.
1 detail in Everything
v0.154.5 adds MongoDB secret rotation, global approvals v1, and AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.154.5 https://github.com/Infisical/infisical.git
$ git checkout v0.154.5
Adds secret-rotation integration for MongoDB app connections and automated secret rotation Introduces global approvals v1 feature allowing cross-project permission requests Adds AWS IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
3 details in Everything
Adds external CA support on PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. CDN CDN A content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.154.4 https://github.com/Infisical/infisical.git
$ git checkout v0.154.4
Adds external CA support on PKI to issue certificates via external certificate authorities Adds export-assets script to package assets for CDN distribution
2 details in Everything
Adds expiring SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.154.3 https://github.com/Infisical/infisical.git
$ git checkout v0.154.3
feat: Adds expiring SCIM token notification feature to alert users before their tokens expire.feat: Switches the SAML authentication flow from certificate-based checks to user alias verification method.
2 details in Everything
Adds DNS Made Easy as an external CA for ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.154.2 https://github.com/Infisical/infisical.git
$ git checkout v0.154.2
feat(dynamic-secrets) : Add retry logic for lease revocation when failingAdd support for DNS Made Easy as an external CA in ACME workflows
2 details in Everything
Adds PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. --domain flag.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.154.1 https://github.com/Infisical/infisical.git
$ git checkout v0.154.1
└──▷ TRY IT
Retrieve a specific authentication token using its ID for automated workflows.
copy
$ curl -X GET https://<infisical-host>/api/v1/auth-tokens/<token-id> \
-H 'Authorization: Bearer <admin-token>' Access secrets for a specific domain through the PAM module during shell execution.
copy
$ infisical login --domain example.com
pam: server-side filter, search, pagination enables filtering and paginating PAM accounts in the UIAdd AWS secret manager PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Add Chef PKI sync for Chef Infra Server secret synchronization [ENG-4142] feat: adds GET endpoint for single auth token by ID exposes a new API endpoint to retrieve an auth token by its ID [ENG-4199] feat: adds group projects table adds a new table view for managing projects within groups in the UI
+2 more
show less
Add self-sign certs support allows issuing certificates signed by the internal CA without external dependencies --domain flag to access modal allows specifying the domain when accessing secrets via the PAM module
7 details in Everything
Adds LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. PKCS12 PKCS12 A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.154.0 https://github.com/Infisical/infisical.git
$ git checkout v0.154.0
Add feature: ldap gateway support to enable LDAP as a gateway source Add systemd interactive deployment option for Gateway & Relay services Introduce secret reference shortcut feature for easier secret injection
3 details in Everything
Adds ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.153.4 https://github.com/Infisical/infisical.git
$ git checkout v0.153.4
Implement ACME enrollment type for PKI Add slack secret sync error notification feature Add certificate auth option for azure-client-secrets in app connections
3 details in Everything
Adds Terraform EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.153.3 https://github.com/Infisical/infisical.git
$ git checkout v0.153.3
└──▷ HOW TO FIND IT
New users can select the Terraform EC2 template when bootstrapping Infisical via the interactive installer.
📍 Run the setup command and select Terraform EC2 when prompted for the infrastructure provider.
New Northflank and Chef data bag app connections with secret sync; PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.153.2 https://github.com/Infisical/infisical.git
$ git checkout v0.153.2
Adds Northflank app connection + secret sync integration. Adds chef data bag app connection and secret sync via the [ENG-4034] feat entry. Enables creation of PKI Subscribers and Templates using the UI.
3 details in Everything
Adds gateway CLI helper, MySQL PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. PAT PAT A personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.153.0 https://github.com/Infisical/infisical.git
$ git checkout v0.153.0
Adds infisical-gateway-deploy interactive CLI command for gateway and relay deployment helpers Adds MySQL as a supported PAM (Privileged Access Management Privileged Access Management Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. pam integration scope Adds Personal Access Token (PAT) support for the GitHub integration Adds certificate auto-renewal and manual renewal workflow support in the PKI subsystem Adds organization-level option to block duplicate destinations on secret syncs
5 details in Everything
Adds account credential rotation via PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.152.0 https://github.com/Infisical/infisical.git
$ git checkout v0.152.0
Adds pam subcommand for service-account and user-account credential rotation with a new template-driven policy model. Moves PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Updates HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. Introduces new navigation structure in the web UI to reduce clicks for account and secret management.
4 details in Everything
Adds Laravel Forge app connection and in-platform migration tooling for Vault policies.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.151.0 https://github.com/Infisical/infisical.git
$ git checkout v0.151.0
feat: Adds laravel forge app connection and secret sync - Enables automatic secret synchronization with Laravel Forge applicationsfeat: in-platform migration tooling for Vault policies + scaffolding - Provides built-in tools to migrate Vault policies within the platform
2 details in Everything
PAM PAM Brokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.150.0 https://github.com/Infisical/infisical.git
$ git checkout v0.150.0
feat(pam) introduces PAM Platform V1feat(audit-log-stream) adds Azure support for audit log streamsfeat(notifications) expands notification coveragefeature(app-connections) adds support for project scoped app connectionsfeat(machine-identities) implements LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
+8 more
show less
Dynamic Secrets now supports Temporary Credentials for AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. feat adds Certificate Syncs and Azure Key Vault SyncRedis app connection and secret rotation support Add Azure SQL Database Dynamic Secret support feat adds SAML group mappingadd qradar as a preview option for log streams adds QRadar as a preview log stream providerfeat(gateway-v2, relays) adds health check on relays and health alertsfeat adds account deletion confirmation email
13 details in Everything
New Cribl audit-log-stream integration, dynamic secret API input reflection, and gateway v2 support
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.149.0 https://github.com/Infisical/infisical.git
$ git checkout v0.149.0
Adds cribl as a supported destination for audit-log-stream in the configuration Introduces gateway v2 support via new backend infrastructure
2 details in Everything
Infisical v0.148.1 adds HashiCorp Vault Gateway support, Redis cluster/replica configuration, and a custom migration UI for vaults
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.148.1 https://github.com/Infisical/infisical.git
$ git checkout v0.148.1
Adds HashiCorp Vault Gateway support to app connection and secret sync workflows, enabling new credential forwarding paths. Introduces Redis cluster support via explicit environment variables for Infisical's internal caching layer, unlocking distributed deployments without single-point failure. Adds REDIS_READ_REPLICA_HOST and related read replica configuration keys to direct cache reads away from the primary instance. Provides a custom migration UI interface within the server admin console for executing vault-to-vault migrations without manual intervention. Enables primary forwarding mode as a new operational surface for managing upstream service dependencies.
+1 more
show less
Reworks Audit Log Stream architecture, likely altering ingestion paths and storage formats for audit data.
6 details in Everything
Infisical v0.148 adds Microsoft ADCS ADCS Active Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.148.0 https://github.com/Infisical/infisical.git
$ git checkout v0.148.0
Adds the Microsoft ADCS external certificate authority connector to allow managing secrets signed by an Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Adds Github Bulk Team Sync integration to synchronize GitHub team memberships with project roles in bulk Enforces Google SSO at the organization level via the enforce_google_sso org setting, preventing non-SSO logins for the organization Adds InstantUpdates support in the k8s operator to propagate secret changes to pods without restarts Adds Universal Auth Login Lockout capability to prevent brute-force attacks on machine identities by blocking repeated failed login attempts
5 details in Everything
Infisical v0.147.1 adds Couchbase dynamic secrets and CSV secret import support.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.147.1 https://github.com/Infisical/infisical.git
$ git checkout v0.147.1
Adds Couchbase as a supported dynamic secrets integration for automated credential rotation Enables secret-import with CSV file support for bulk loading secrets
2 details in Everything
Infisical v0.147.0 adds nightly release channels and removes the -postgres Docker tag suffix.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.147.0 https://github.com/Infisical/infisical.git
$ git checkout v0.147.0
└──▷ USE IT
Pull the nightly unstable build for early access to features.
shell
copy
docker pull infisical/infisical:nightly
Adds nightly to the available Release Channels Removes the -postgres suffix from all new Docker image tags
2 details in Everything
└──▷ BREAKING ON UPGRADE
! New Docker tags no longer include the -postgres suffix (e.g., use infisical/infisical:latest instead of infisical/infisical:latest-postgres)
Infisical v0.146 adds SRP removal, new last logged in auth method field, sticky secret table headers, and MSSQL servername host support
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.146.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.146.0-postgres
Removes the deprecated SRP protocol by @DanielHougaard in https://github.com/Infisical/infisical/pull/4270 Adds last logged in field to track which authentication method was last used for an account Makes the secret overview table header sticky with underlines for env links and a limited height for scrolling Updates frontend styling and overflow behavior for the audit log filter
4 details in Everything
Infisical v0.145.0 adds audit log storage disable flag, GitHub Enterprise integration, and LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.145.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.145.0-postgres
Adds auditLog.disableStorage config key to prevent audit logs from being persisted in the database Adds GitHub Enterprise Server as a supported connection target for app integrations Adds LDAP authentication support for the Infisical Kubernetes agent-injector operator
3 details in Everything
Infisical v0.144.0 adds GitLab secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.144.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.144.0-postgres
feature(secret-scanning) : enables native GitLab Secret Scanning integration for discovering exposed credentials in GitLab repositories.feat(app-connections, PKI) : adds Cloudflare as a supported DNS provider for application connections.feat: introduces Netlify app connection and automatic secrets synchronization.HSM support is added to the main Docker image, enabling Hardware Security Module Hardware Security Module A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. The new events system implementation provides event-driven capabilities within the platform.
+1 more
show less
New server admin bulk operations: a bulk delete users endpoint and corresponding UI table actions.
6 details in Everything
Adds Azure Client Secrets authentication to Azure App Connections in Infisical v0.143.0
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.143.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.143.0-postgres
Adds secrets detection engine and GitHub App sync gateway to Infisical v0.142.0
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.142.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.142.0-postgres
Adds secrets detection in secret manager capability to scan for leaked credentials within stored secrets. Adds a new Gateway for GitHub App Connections & Secret Syncs enabling bidirectional sync between GitHub Apps and Infisical.
2 details in Everything
Infisical v0.141.0-postgres introduces multi-environment support for secret/access policies and refactors Azure OAuth env var handling.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.141.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.141.0-postgres
└──▷ HOW TO FIND IT
When applying secret or access policies to multiple environments at once (e.g., staging and prod) in the UI.
📍 In the Infisical console, go to Secrets › Policies and enable multi-environment selection for the policy you are creating or editing.
When configuring Azure OAuth connections in a cyber tool service container where previous shared env vars caused collisions across multiple apps.
📍 export AZURE_APP_1_CLIENT_ID='xxx'
export AZURE_APP_1_TENANT_ID='yyy'
# ... separate vars for each app connection as introduced in this release
Allow multiple environments on secret and access policies — enable scoped policies across several environments simultaneously instead of a single environment.Separate Azure OAuth env vars to different env variables for each app connection — split shared Azure OAuth configuration into distinct environment variables per application connection.
2 details in Everything
Auto-redeploy on sync for Render, Azure CS auth, and frontend column resize
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.140.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.140.0-postgres
Adds auto redeploy trigger in Secret Sync when target is Render, so secrets pushed to Infisical automatically restart the deployment Adds support for Client Secrets authentication when connecting an Azure Cloud Services app via Secret Import Adds horizontal column resizing to the Secret Dashboard Environment View in the frontend
3 details in Everything
Infisical v0.139.2 adds project audit logs pages and AWS ABAC ABAC Attribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.139.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.139.2-postgres
Add AWS attributes for ABAC to machine identities enables attribute-based access control attribute-based access control Attribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. project-audit-logs pages added to the UI for tracking project-level actions.
2 details in Everything
Infisical v0.139 adds Bitbucket Secret Sync, Digital Ocean App Platform sync, and SQL gateway connections with rotation.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.139.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.139.0-postgres
feat(app-connection) : Gateway support for SQL App Connections + Secret Rotationsfeat(app-connection, secret-rotation) : Okta App Connection + Okta Client Secret Rotationfeat: Move products out of projectsfeat: Digital Ocean App connection and App Platform secret sync
4 details in Everything
Infisical v0.138.0 adds Railway, Cloudflare Workers, Supabase and Checkly secrets sync, AWS IRSA IRSA An AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. --output-file, server admin overrides, and offline docs
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.138.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.138.0-postgres
Adds INFISICAL_RAILWAY_SECRET_SYNC_ENABLED and related overrides to enable automatic Railway secret sync Adds INFISICAL_CLOUDFLARE_WORKERS_SYNC_ENABLED and related overrides to enable Cloudflare Workers secrets sync Adds INFISICAL_SUPABASE_APP_CONNECTION_ENABLED and INFISICAL_SUPABASE_SECRET_SYNC_ENABLED to support Supabase app connection and secrets sync Adds INFISICAL_CHECKLY_APP_CONNECTION_ENABLED and INFISICAL_CHECKLY_SECRET_SYNC_ENABLED to support Checkly app connection and secrets sync Enables AWS IRSA authentication for dynamic secrets via the new aws_irsa auth method
+4 more
show less
Adds native FIPS mode via the FIPS_ENABLED environment variable Updates CLI export to accept a concrete file path with the --output-file <path> argument instead of stdout-only output Adds server admin environment overrides for configuring the GitHub app connection (including migration from UI) Allows documentation site to run fully offline
9 details in Everything
Adds Bitbucket data source for secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.137.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.137.0-postgres
Adds Bitbucket as a new data source for the secret-scanning feature with App Connection support
1 detail in Everything
Infisical v0.136.0 adds BitBucket to secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.136.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.136.0-postgres
Adds TLS cert identity auth, Zabbix secret sync, environment overrides, project UI v3, and plain CLI token output
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.135.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.135.0-postgres
└──▷ USE IT
Retrieve a raw token string for direct use in scripts without JSON parsing.
shell
copy
infisical auth get-token --plain
Adds TLS cert identity auth for client certificate-based authentication Adds Zabbix to supported secret sync providers Adds Environment Overrides feature in super-admin settings Adds plain text output support to infisical auth get-token CLI command via --plain flag Adds type column and default sort to the project roles table in the UI
+6 more
show less
Adds revamp of approval sequence table display and access request modal for improved UX Adds standardization of org access control UI across the platform Adds blocking of folder deletion if secrets within are protected by an active policy Adds re-invite workflow to automatically resend expired user invites every 1 week for up to a month Adds color/layout styling adjustments to the secret approval request page Adds ability to allow users with create permission to add identities with no access
11 details in Everything
Adds GitLab secret sync and revamps the edit role page in v0.134.0
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.134.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.134.0-postgres
Adds GitLab secret sync integration for automated secret synchronization
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! The secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it.
Adds Cloudflare secret sync, GitHub self-serve connection, undefined tag support, and projectSlug to secrets v3 endpoints
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.133.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.133.1-postgres
projectSlug parameter added to secrets v3 API endpoints for project identificationSelf-serve connection setup now available for the GitHub app integration Cloudflare app connection with automatic secret synchronization supported Auto-bootstrap support added to the Helm chart deployment Copy token button added to the UI for API keys
5 details in Everything
Infisical v0.133 adds GCP IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. EKS EKS Amazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.133.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.133.0-postgres
Adds GCP IAM as a supported provider for Dynamic Secrets. Introduces Fly.io Secret Sync integration for App Connections. Enables Point-In-Time Recovery (PITR) revamp with new snapshot handling.
3 details in Everything
infisical-cli v0.41.85 adds --project-slug support for dynamic secret commands
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.41.85 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.41.85
Adds --project-slug flag to dynamic secret subcommands, enabling targeted credential generation and rotation without context switching
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! Flags have been converted from snake_case or camelCase to dash-case (e.g., --project_slug is now --project-slug); existing scripts using the old format will fail
Infisical v0.132.4 adds k8s metadata in template policies, assume role mode for AWS dynamic secrets, and location support for GCP sync.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.132.4-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.132.4-postgres
Enables assume role mode for AWS dynamic IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Adds support for syncing GCP dynamic secrets to specific locations Includes identityName in the Dynamic Secrets userName template
3 details in Everything
Adds Vertica dynamic secrets, secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. {{environment}} support in key schemas
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.132.3-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.132.3-postgres
Adds vertica as a supported dynamic secret type for automated credential rotation. Introduces the secret-scanning-v2 architecture with a new github data source for detecting secrets in repositories. Adds {{environment}} variable support within key schemas, allowing environment-aware naming. Updates org users table to include a filter by roles capability.
4 details in Everything
infisical-cli v0.41.8 adds gateway auth for Kubernetes identities
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.41.8 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.41.8
Uses the gateway as a token reviewer for identities/kubernetes-auth
1 detail in Everything
Restores describeReadValue permission to default roles and adds role sorting in user/identity views.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.132.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.132.2-postgres
infisical-cli v0.41.6 adds automatic session renewal and new background spawn logic
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.41.6 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.41.6
Adds infisical login behavior to automatically re-authenticate when a session expires or becomes invalid, reducing manual intervention. Changes infisical login to spawn a new session process instead of overwriting the current one, improving reliability.
2 details in Everything
Adds MySQL secret rotation v2, dynamic secret username templates, and an organizations overview UI for infrastructure management
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.132.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.132.1-postgres
Adds feat(secret-rotation): MySQL Secret Rotation v2 to rotate MySQL credentials automatically Introduces Feat/dynamic secret username template for generating dynamic usernames in secrets Adds organizations overview and control under instance-management for managing infrastructure at scale
3 details in Everything
Adds PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. ACME ACME An IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.132.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.132.0-postgres
Adds ACME and external CA support for PKI to manage certificates Adds Redis Sentinel support for high availability configuration Adds --region flag to the CLI for selecting deployment regions Adds Kubernetes dynamic secret generation capability Allows machine identities to read billing information
+1 more
show less
Adds token period support for user authentication
6 details in Everything
Infisical v0.131 adds 1Password secret sync, custom SMTP SMTP The application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.131.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.131.0-postgres
Adds 1Password Secret Sync integration as a new source for synchronizing secrets Supports custom CA Certs in the smtp-service configuration for TLS verification Logs organization updates and project create/update/delete events to audit logs Enables bypassing approval requests via a specific policy permission
4 details in Everything
Infisical v0.130.1 adds LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.130.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.130.1-postgres
feature(secret-rotation) now supports target principal self-rotation for LDAP using UPN (User Principal Name).
1 detail in Everything
Enables per-organization shared secret limits and allows specifying email addresses for secret sharing.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.130.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.130.0-postgres
Adds feat(org): Shared Secret limits for org to cap the number of shared secrets an organization can have Adds feat(secret-sharing): Specify Emails to allow providing specific email addresses during secret sharing
2 details in Everything
Gateway support for identities; hide specific products from sidebar via org settings
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.129.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.129.1-postgres
Adds gateway support for identities to allow identity-based authentication flows through the gateway Adds an option in Organization Settings to hide specific products from the application sidebar
2 details in Everything
Infisical v0.129 adds Oracle Cloud machine identity auth and duplicate org/project roles
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.129.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.129.0-postgres
feat(machine-identities): oracle cloud machine identity authfeature(project/org-roles): Add ability to duplicate org and project roles
2 details in Everything
Infisical v0.128.0 adds OCI OCI Open Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.128.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.128.0-postgres
feat(secret-sync): OCI Vault allows syncing secrets from Oracle Cloud Infrastructure Vault
1 detail in Everything
Rate limits on email endpoints, OpenAPI OpenAPI A vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.127.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.127.2-postgres
Adds rate limiting to all email-sending API endpoints Supports OpenAPI titles for Zod descriptions in the API docs Adds groups to SSH hosts allowed principals for fine-grained access control Improves project templates UI with new layout and interaction enhancements
4 details in Everything
Adds Kubernetes generator support and admin cache invalidation to Infisical
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.127.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.127.0-postgres
k8s generators now support generating manifests directly from Infisical secrets for Kubernetes workloadsAdmin interface gains a new Invalidate Cache action to force-clear the application cache without restarting the service
2 details in Everything
Infisical v0.126 introduces SSH host groups and a Gateway Helm chart.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.126.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.126.0-postgres
└──▷ USE IT
Restrict the Infisical web UI to specific domains by setting an environment variable.
shell
copy
ALLOWED_HOSTS=example.com npm run dev
Adds ALLOWED_HOSTS environment variable to vite.config for controlling allowed hosts. Introduces Host Groups support in Infisical SSH. Adds a new infisical-gateway Helm chart for deployment.
3 details in Everything
Adds Microsoft Teams and HashiCorp Vault integrations, customizable token expiration, and imported secret sync
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.125.3-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.125.3-postgres
Adds microsoft_teams to the workflow-integrations config for notification triggers Adds HashiCorp Vault App Connection & Secret Sync integration (new secret-sync target) Makes users auth token expiration customizable per organization via a new setting Syncs imported secrets through the agent feature
4 details in Everything
Infisical adds strict find filter and TeamCity sync improvements in v0.125.2
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.125.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.125.2-postgres
└──▷ USE IT
Use strict matching to avoid ambiguity when looking up secrets with similar keys.
shell
copy
infisical find --strict
strict_find filter now applies stricter matching logic for secret lookups.TeamCity integration ignores inherited and non-environment values during secret sync.
2 details in Everything
Infisical v0.125.1 adds SSH aliases, GitHub org sync, PKCE PKCE Proof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.125.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.125.1-postgres
Adds an Alias field to SSH hosts for easier identification in the Infisical SSH client Implements project permission impersonation allowing users to act as other roles within a project Adds recipients specification in reminders via feat(reminders) to target specific users or groups Allows sorting of permissions in the UI for better management of project-level access controls Enables GitHub organization sync for automated team and permission mapping
+3 more
show less
Configures SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Updates all SSO login methods to use PKCE protocol for enhanced authentication security Increases secret caching duration to 10 minutes with a 2-minute jitter to reduce cache misses while maintaining freshness
8 details in Everything
Infisical v0.125 adds AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.125.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.125.0-postgres
└──▷ USE IT
Retrieve a user token via the new CLI interface for non-interactive scripting.
shell
copy
infisical auth get-token
feat: add user get token CLI and revamp session managementfeat(secret-rotation-v2): Add AWS IAM User Secret rotationFeature: LDAP Connection and Password Rotationfeat(secret-sync): TeamCity App Connection & Secret SyncAdmin SSO bypass (break-glass login) sends out email to all org admins + creates audit log
5 details in Everything
New user get-token command and revamp session management
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.40.1 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.40.1
└──▷ TRY IT
Retrieve a user token for programmatic access using the new command
copy
$ infisical user get-token --user-id <USER_ID> Use SSH v2 in non-interactive environments like CI/CD pipelines
copy
$ infisical ssh connect --non-interactive
Enables SSH v2 operation in non-interactive mode, allowing default SSH CA reassignment
1 detail in Everything
Infisical v0.124 introduces project delete protection and Windmill sync integration
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.124.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.124.0-postgres
Adds project_delete_protection setting to prevent accidental deletion of projects in Infisical Org Settings
1 detail in Everything
Adds metadata-based permissions for dynamic secrets, Auth0 secret rotation, and configurable OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.123.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.123.2-postgres
Adds metadata_based_permissions configuration option to enable permissioning on dynamic secrets via metadata Adds UI controls for rotating Auth0 Connection Client Secrets directly within Infisical Makes the JWT signature algorithm configurable for OpenID Connect OpenID Connect OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
3 details in Everything
Infisical v0.123.1 adds INFISICAL_ALLOW_INTERNAL_IPS env var and secret deletion warnings
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.123.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.123.1-postgres
Adds the INFISICAL_ALLOW_INTERNAL_IPS environment variable to control whether internal IP connections are permitted. Adds a warning prompt when attempting to delete a secret that is currently imported by another folder.
2 details in Everything
Infisical v0.123 adds KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.123.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.123.0-postgres
feat(kms) adds the ability to sign and verify data using Key Management Service Key Management Service A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
1 detail in Everything
infisical-cli/v0.40.0 adds a new infisical ssh subcommand suite and SSH host certificate issuance capability
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.40.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.40.0
Adds infisical ssh connect CLI command for connecting to hosts via SSH using managed credentials. Adds infisical ssh add-host CLI command with a new --configure-sshd flag to automatically update remote sshd_config files during host registration. Adds backend endpoint and logic for issuing SSH host certificates (Add infisical ssh host endpoint for issuing ssh host cert ). Adds writeHostCaToFile CLI functionality to write the host certificate authority file locally for verification purposes.
4 details in Everything
Infisical v0.122 adds Vercel and Terraform Cloud integrations, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.122.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.122.0-postgres
└──▷ USE IT
Retrieve a specific project identity using a user's membership ID within that project
shell
copy
curl https://app.infisical.com/api/projects/<project_id>/identities/membershipId/<membership_id> -H 'Authorization: Bearer $INFISICAL_TOKEN'
Adds vercel secret sync integration for automating secret propagation to Vercel projects Adds terraform_cloud integration to synchronize secrets directly with Terraform Cloud workspaces Adds ssh_v2 protocol support in the Infisical SSH agent for enhanced key handling and security Adds camunda app connection capability allowing secret sync between Infisical and Camunda workflows Adds access_request_note field to capture context during access or change requests
+1 more
show less
Adds API endpoint /api/projects/{projectId}/identities/membershipId/{membershipId} to retrieve project identity by membership ID
6 details in Everything
Adds automatic Kubernetes service account token creation and identity API role filtering.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.121.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.121.0-postgres
└──▷ USE IT
Query only identities with a specific role via the API.
shell
copy
curl -H "Authorization: Bearer $TOKEN" "https://infisical.example.com/api/orgs/$ORG_ID/identities?role=admin"
feat(k8s) enables automatic creation of service account tokens for Kubernetes authentication.filter by role is now supported in the org identity endpoint to limit returned results.Rate limits have been removed for self-hosted deployments.
3 details in Everything
Infisical v0.120.0 introduces Secret Rotations v2, filtered audit logs, and folder replication
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.120.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.120.0-postgres
└──▷ USE IT
Query only audit events related to a specific secret key for compliance review
shell
copy
curl https://<infisical-host>/api/audit-logs?secretKey=my-secret-key
Adds GET /api/audit-logs?secretKey=<key> query parameter to filter audit log entries by the specific secret Added INFISICAL_INTERNAL_IP environment variable for dynamic secrets to expose internal IPs
2 details in Everything
Adds secrets set --file support for CLI bulk loading and custom HTTP headers via new CLI flag.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.119.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.119.0-postgres
--headers flag added to CLI commands to allow sending custom HTTP headersinfisical secrets set now accepts a --file argument for bulk key-value loading from text files
2 details in Everything
CLI adds --custom-headers flag and secrets set gains file input support.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.36.22 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.36.22
└──▷ USE IT
Read secret values from a file instead of passing them inline
shell
copy
infisical secrets set key=mysecret --input-file ./secrets.txt
Adds --custom-headers flag to CLI commands for injecting arbitrary HTTP headers Adds --input-file (or -i) option to secrets set key=value command for reading values from a file
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The customHeaders config field in the SDK now expects a different format than previous versions
Adds ability to prevent reviewers from approving their own project approval requests; improves machine identity login performance.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.118.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.118.1-postgres
└──▷ HOW TO FIND IT
Enforce separation of duties so a developer cannot approve their own secret request.
📍 In the project settings, navigate to the Approval Workflow configuration and disable the option allowing reviewers to self-approve.
Allow project approval workflows to set if a reviewer can or can not review their own requests feat: client secret compare optimization in machine identity login
2 details in Everything
Adds recursive folder retrieval, file-based secret imports, dynamic secrets modal, and k8s short-lived JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.118.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.118.0-postgres
└──▷ TRY IT
Retrieve all nested folders under a specific path without pagination loops
copy
$ curl -H 'Authorization: Bearer <token>' 'https://app.infisical.com/api/v1/folders?workspaceId=<workspace>&folderPath=/&recursive=true' Import multiple secrets at once from a .env file in CI/CD pipelines
shell
copy
infisical secret set --file ./config/.env --workspaceId <workspace> --env production
GET /folders endpoint now supports a recursive=true flag to retrieve all nested folders in a single call.infisical secret set CLI command adds --file option to import secrets from .env or .yaml files.Secrets overview page gains a dynamic secrets modal form for creating new dynamic secrets. UI shows visual indicators when folders contain imports directly in the secret overview page. Audit log now includes permission metadata for actions, aiding in compliance reviews.
5 details in Everything
infisical-cli/v0.36.19 adds --file import for secret set and CLI environment variable support.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.36.19 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.36.19
└──▷ USE IT
Import a set of secrets defined in a .env file directly into an Infisical project using the CLI.
shell
copy
infisical secret set --file path/to/secrets.env
Adds --file flag to the secret set command to load secrets from .env or .yaml files instead of manual arguments. Enables environment variable configuration for all other CLI flags, allowing flag values to be sourced from the environment.
2 details in Everything
Adds Kubernetes ConfigMap support, Humanitec secret sync integration, and share to anyone capability.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.117.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.117.0-postgres
Adds configmap support for Infisical data in Kubernetes environments Adds Humanitec secret sync integration for automated secret distribution Adds Share to anyone edition capability allowing broader secret sharing scopes
3 details in Everything
Adds --skip-env-check flag and improved environment validation in infisical run.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.36.17 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.36.17
Improves infisical run by adding explicit validation that ensures a project contains the requested environment before fetching secrets; if missing, the command fails with a clear error instead of silently proceeding or crashing.
1 detail in Everything
Adds admin console view for machine identities and a Role Access Tree UI component
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.116.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.116.0-postgres
Add is-admin filter to Server Admin Console Feature: Role Access Tree
2 details in Everything
infisical-cli adds install subcommand for systemd gateway management
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.36.16 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.36.16
└──▷ USE IT
Install the Infisical Gateway via CLI for later service management, useful in automated deployment scripts.
shell
copy
infisical gateway install
Infisical v0.115.0 adds actor tracking in secret history, new get by ID API endpoint, and webhook triggers for reminders
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.115.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.115.0-postgres
Adds GET /api/secrets/:id API endpoint to retrieve a specific secret directly by its ID Includes the actor (user) who performed an action in the secret version history view Adds the secret name to Slack notifications for alerts and reminders Adds new webhook trigger capability for secret reminder events
4 details in Everything
Secret requests workflow, QUIC QUIC A UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.114.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.114.0-postgres
└──▷ HOW TO FIND IT
Review and approve secret sharing requests via the new workflow feature.
📍 In the Infisical console, navigate to the Secret Requests section to review incoming secret-sharing proposals.
Adds secret-sharing feature to enable secret requests for review. Adds Save Secret Reminder from the modal UI to schedule reminders. Adds Add descriptions to secret folders capability allowing metadata on folder structure. Adds QUIC protocol support to the gateway for improved transport performance. Enables server admins to grant server admin access to other users.
5 details in Everything
Infisical adds auto-redeploy for Kubernetes deployments and dev migration commands
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.113.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.113.0-postgres
Adds --auto-redeploy flag to automatically trigger redeployment of DaemonSet and StatefulSet resources upon secret changes
1 detail in Everything
infisical-cli v0.35.0 adds gateway CLI commands and a built-in KMIP server
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.35.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.35.0
Adds gateway subcommands to the CLI for managing gateway connections Adds a built-in KMIP server accessible via the CLI Improves heartbeat messaging feedback in the CLI
3 details in Everything
Infisical v0.112.0 adds batch upsert capability for managing secrets at scale.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.112.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.112.0-postgres
Improves UI responsiveness by switching from isLoading to isPending state handling
1 detail in Everything
Adds native Databricks sync and Azure App Config/Key Vault support; auto-runs DB migrations.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.111.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.111.0-postgres
feat(secret-syncs): azure app config & key vault support enables syncing secrets from Azure App Configuration and Key VaultFeature: Databricks Connection & Sync adds native Databricks as a secret destination for sync operationsDatabase migrations now run automatically at startup, removing the need for manual migration steps
3 details in Everything
Infisical v0.110.0 adds AWS Secrets Manager sync and metadata filtering for secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.110.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.110.0-postgres
Adds aws_secrets_manager_sync config key to .env or environment variables to enable automatic syncing of secrets from AWS Secrets Manager Adds GET /api/v1/secrets?metadataKey=&metadataValue= query parameters to the secrets list endpoint for filtering by metadata Includes secret metadata fields in audit log entries
3 details in Everything
Adds AWS Secrets Manager sync and metadata-based secret filtering via API
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.108.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.108.1-postgres
└──▷ TRY IT
Retrieve only secrets tagged with a specific environment label via the API
copy
$ curl -H 'Authorization: Bearer $INFISICAL_TOKEN' 'https://app.infisical.com/api/v1/secrets?metadata_key=env&metadata_value=prod'
Adds aws.secretsmanager.sync integration to pull secrets from AWS Secrets Manager into Infisical Adds GET /api/v1/secrets?metadata_key=<key>&metadata_value=<value> filter to list secrets by metadata Includes secret metadata fields in audit log entries for visibility
3 details in Everything
v0.108.0-postgres increases the GCP service account credential length limit for identity auth.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.108.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.108.0-postgres
Increases Identity GCP authentication credential limit from 255 to platform-specific limits (e.g., ~30k+ characters). Excludes Reserved Folders from Deep Search folder queries.
2 details in Everything
Adds a Secrets Overview page with the ability to move secrets between environments
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.107.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.107.0-postgres
Infisical v0.106 adds OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.106.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.106.0-postgres
K8 Operator now supports multiple secret references per InfisicalSecret resource
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.105.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.105.0-postgres
InfisicalSecret CRD CRD A Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. Improvement: Overhaul Identity Auth UI Section
2 details in Everything
Introduces Secret Syncs feature to synchronize secrets across environments.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.104.4-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.104.4-postgres
Adds Secret Syncs capability to automatically synchronize secrets between environments Updates UI validation for environment variables to match API limits (64 characters)
2 details in Everything
Infisical v0.104.0 adds Radar export and pagination, unique Group names, and S3 secret key visibility in sync errors.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.104.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.104.0-postgres
└──▷ TRY IT
Retrieve the second page of Radar signals using pagination controls.
copy
$ curl -G 'https://<infisical-host>/api/radar/signal' \
--data-urlencode 'limit=50' \
--data-urlencode 'offset=50'
limit and offset query parameters for Radar list endpoints to support pagination and filteringEnforcement of unique names within Infisical Groups
2 details in Everything
Infisical v0.103.0 adds Radar data export, pagination/filtering for Radar views, unique group names, and improved AWS Parameter Store integration error reporting.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.103.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.103.0-postgres
Adds feat(radar): export radar data capability to allow exporting data from the Radar feature Adds pagination and filtering support for Radar views (feat(radar): pagination and filtering) Enforces unique names for groups (feat(groups): unique names) Improves AWS Parameter Store integration sync errors by including the Secret Key in error messages
4 details in Everything
Infisical v0.102.0 adds custom CORS CORS A browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.102.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.102.0-postgres
feat(api): custom cors settingsfeat(audit-logs): shared secrets audit logs
2 details in Everything
Infisical v0.101.2 adds Auth0 SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.101.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.101.2-postgres
Adds Auth0 SAML integration support for authentication Improves the User Group Feature Upgrade Modal to clarify Enterprise Plan requirements
2 details in Everything
Support for targeting specific Azure Key Vault tenants
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.101.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.101.1-postgres
Adds ability to target a specific Azure Key Vault tenant
1 detail in Everything
Adds ssh issue and ssh sign commands with optional --addToAgent flag for automatic key loading
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.33.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.33.0
└──▷ TRY IT
Issue a short-lived SSH credential and inject it into your current session's ssh-agent for immediate use.
copy
$ infisical ssh issue dev-host --path /app/config --workspace-id ws_abc123 --addToAgent Save the generated private key to a local file for use in non-interactive scripts or CI pipelines.
copy
$ infisical ssh issue ci-runner --outFilePath /tmp/ci_ssh_key
infisical ssh issue <name> [--path <path>] [--workspace-id <id>] --addToAgent: issues a new SSH credential and optionally loads it into the local ssh-agent.--outFilePath <path> flag allows ssh issue to save the private key directly to a file instead of stdout.
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The ssh issue command now requires either the --addToAgent or --outFilePath flag; omitting both will result in an error.
Adds --tenant-id flag to CLI auth command for Azure Key Vault integration.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.100.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.100.0-postgres
└──▷ USE IT
Use when your environment has multiple AAD tenants and you need to target a specific one for Key Vault access.
shell
copy
infisical auth --backend key-vault --tenant-id <your-tenant-guid>
Enables authenticating against a specific Azure Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. --tenant-id CLI argument.
1 detail in Everything
New CircleCI context sync integration and SSH certificate issuance/signing endpoints for cyber tooling.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.99.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.99.0-postgres
feat(integrations): New CircleCI Context SyncInfisical SSH (SSH Certificates) support with exposed API endpoints CLI - SSH Capabilities including the addToAgent flag to load credentials into SSH Agent
3 details in Everything
└──▷ BREAKING ON UPGRADE
! PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
Infisical v0.98.0 adds k8s operator template support and an API endpoint to update integration auth
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.98.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.98.0-postgres
misc: add ssl setting for pg boss enables SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. New PATCH /api/integrations/:id/auth endpoint (added via PR #2855) allows updating integration authentication credentials
2 details in Everything
Adds Google GCP KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.97.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.97.0-postgres
└──▷ HOW TO FIND IT
Register Google GCP KMS as the encryption backend for a project.
📍 1. Go to Project Settings › Encryption
2. Select Google GCP KMS from the Provider dropdown
3. Enter your GCP Service Account JSON and Key ID
When an API call fails, copy the request ID from the UI error toast to paste into support tickets.
📍 1. Perform an action that results in a server error (e.g., invalid secret payload)
2. Look at the red error toast message
3. Click the Copy icon next to the Request ID field
Adds Google GCP KMS as a supported external KMS provider for encrypting secrets at rest Add copyable request IDs to server-side error messages in the UI to aid troubleshooting
2 details in Everything
Adds TOTP TOTP A one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. OTEL OTEL An open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.96.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.96.1-postgres
feat: added setup for production observability (metrics via OTEL) feat: TOTP dynamic secret providerfeat: request ID support
3 details in Everything
Infisical v0.95.0 adds a TOTP TOTP A one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.95.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.95.0-postgres
feat: TOTP authenticator adds Time-based One-Time Password support for multi-factor authentication multi-factor authentication Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
1 detail in Everything
Adds tag support on secret creation, EST device enrollment without bootstrap certs, and HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.94.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.94.0-postgres
Adds tags field to create-secret endpoints for grouping secrets by label Enables adding Project Templates to organize recurring secret configurations Adds static LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Adds Deployment Environment Scope support for Bitbucket integration filters Adds support for EST (Enrollment over Secure Transport) device enrollment without requiring bootstrap certificates
5 details in Everything
Adds automatic Service Account creation for job and deployment secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.93.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.93.2-postgres
Add support for auto creating SA for job and deployment Added queue level debounce for secret sync
2 details in Everything
Adds MSSQL secret rotation template support
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.93.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.93.0-postgres
Infisical v0.92.0 adds Snowflake dynamic secrets, OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.92.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.92.0-postgres
Snowflake Dynamic Secrets integration for rotating Snowflake credentialsOIDC Default Org setting to route unauthenticated users to a specific organizationSecrets Dashboard Quick/Deep Search capability in the UIMultiple auth methods support for identities allowing SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Default pagination size increased to 100
5 details in Everything
Adds SAP HANA dynamic secrets support and custom CA for the K8 operator.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.91.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.91.0-postgres
└──▷ USE IT
Add a custom CA to the Kubernetes operator configuration.
yaml
copy
apiVersion: helm.infisical.com/v1
kind: OperatorConfig
spec:
k8s:
customCa: |
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
feat: secret reference graphfeat: envkey import refactorfeat: add support for custom ca in k8 operator with helm related configs added in misc: added helm related configs for operatorfeat: SAP HANA dynamic secrets
4 details in Everything
Infisical CLI v0.31.4 adds MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.31.4 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.31.4
v0.90.1 introduces org-level MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.90.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.90.1-postgres
feat: moved mfa to org levelfeat: allow approvers to bypass secret change requests
2 details in Everything
Infisical v0.90.0 adds SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.90.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.90.0-postgres
SCIM Group to Organization Role Mapping allows synchronizing SCIM groups directly to Infisical organization rolesGithub app auth enables GitHub integration via the native GitHub App authentication flowsecret scanning whitelist configuration provides a new mechanism to define secrets that should be ignored during scanning
3 details in Everything
Adds EU cloud region support, server-based expandSecretReferences, and JSON args for get secrets
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.31.2 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.31.2
Adds cloudEU support for deploying Infisical to a European Union region. Switches expandSecretReferences from client-side to server-based expansion, extending the same capability to templates. Adds secret_path field to the template output and accepts optional arguments passed as JSON to the get secrets command.
3 details in Everything
Infisical v0.89.0 adds queue-based Envkey imports, ghost user creation, and secret path to templates.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.89.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.89.0-postgres
Adds Process Envkey import in queue to background Envkey migration tasks Adds auto ghost user creation for accounts without associated users Adds secret path field to template configurations Allows optional additional arguments when using the secret path template feature
4 details in Everything
Adds RPM binary support, opt-in audit log partitioning, default org membership role setting, and multi-select UI component
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.88.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.88.0-postgres
Adds rpm binary for Linux installations Makes audit log database partitioning opt-in via configuration Adds a Multi-Select component to improve adding users to projects
3 details in Everything
Infisical v0.87.0 introduces KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.87.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.87.0-postgres
KMS MVP now available for server-side encryption of secrets in the overviewDatabricks integration allows syncing secrets to Databricks workspaces LDAP support added for generating dynamic secrets via LDAP backend New Terraform import prerequisite checks and API improvements for terraform import workflows Data Region Select UI control for choosing data residency regions
+1 more
show less
Users can now replace existing authentication methods (e.g. switching SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
6 details in Everything
Infisical v0.86.0 adds Azure Entra ID Entra ID Microsoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.86.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.86.0-postgres
Adds Azure Entra ID as a supported provider for dynamic secrets generation Moves audit logs to organization-level scope instead of project-level Enables server-side pagination on Secrets Overview and Main Pages for improved performance Allows access approvals to be granted via user groups Configures email notifications when an integration sync fails
5 details in Everything
Infisical v0.85.0 adds AWS Secrets Manager prefixing and an integration details logging page.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.85.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.85.0-postgres
feat(integrations): aws secrets manager secrets prefixing supportfeat: integration details page with logging
2 details in Everything
Infisical v0.84.0 adds native Slack integration, certificate key usage configuration, and bulk member invitations.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.84.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.84.0-postgres
native slack integration allows Infisical to send secrets or notifications directly to Slack channels.Supports configuring certificate key usage and extended key usage for PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Allows inviting multiple members to a project with role assignment in a single action.
3 details in Everything
Infisical v0.83.0 adds Dynamic Secret support for MongoDB and OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.83.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.83.0-postgres
Adds Dynamic secret/mongodb capability to enable on-the-fly credential generation for MongoDB databases Supports glob patterns for OIDC authentication, allowing more flexible group/user matching
2 details in Everything
Adds Elasticsearch visibility support to GitHub integration and Elastic secrets backend
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.82.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.82.1-postgres
Adds dynamic-secrets Elasticsearch support for generating dynamic credentials Adds visibility options (read/write/none) to the GitHub integration for controlling secret propagation scope
2 details in Everything
Adds password protection for secret shares and MongoDB Atlas dynamic secrets
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.82.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.82.0-postgres
feat: password protect secret share allows sharing secrets with a required password.MongoDB atlas dynamic secret enables automatic generation of MongoDB Atlas credentials.
2 details in Everything
└──▷ BREAKING ON UPGRADE
! v0.82.0-postgres contains a breaking change; upgrade to v0.82.1-postgres or higher to avoid issues.
infisical-cli v0.28.7 adds --watch flag to infisical run for live secret updates and hot reload settings.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.28.7 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.28.7
Adds hot-reload.enabled and hot-reload.interval configuration keys under settings to control automatic reloading behavior
1 detail in Everything
Adds Redis support for dynamic secrets
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.81.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.81.2-postgres
Adds Certificate Extension Server Trust (EST) protocol support for automated certificate enrollment.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.81.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.81.1-postgres
Adds support for the Certificate EST protocol, including simpleenroll, simplereenroll, and cacerts operations Adds a configurable timeout for EST connections
2 details in Everything
Azure DevOps integration, role/project selection on invite, and email notifications for secret change requests.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.81.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.81.0-postgres
Adds azure-devops as a supported service integration for automated secret provisioning Enables selecting specific roles and projects when inviting members to an organization via the UI or API Adds new email notifications triggered on secret change requests, configurable per environment or project
3 details in Everything
Infisical v0.80 introduces certificate templates and group-level support for access requests.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.80.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.80.0-postgres
certificate_templates feature allows defining reusable certificate configurationsGroup support added for access_requests in core service logic
2 details in Everything
infisical-cli/v0.28.5 adds tag support for secret operations and simplifies auth by removing local workspace file requirement.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.28.5 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.28.5
feat: added tag support for secret operation in climisc: made local workspace file not required if using auth token
2 details in Everything
Adds tag-based filtering for the secret API and improves migration performance via chunked inserts.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.79.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.79.0-postgres
Secret migration switched to chunking based batch insert
1 detail in Everything
infisical-cli v0.28.0 adds --vault-password-file for automated vault integration
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.28.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.28.0
└──▷ USE IT
Automate non-interactive authentication in CI/CD by passing the keyring password via a secret-managed file.
shell
copy
infisical login --vault-password-file /run/secrets/vault_pw
Adds --vault-password-file flag to infisical login to specify a file containing the encrypted vault password
1 detail in Everything
Infisical v0.78.0 introduces secrets engine v2, external KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.78.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.78.0-postgres
secrets engine v2 is now available, providing a new backend for secret storage and retrievalSupports external kms providers to manage encryption keys outside the platform The CLI now supports a persistent file vault passphrase via the new file vault mechanism
3 details in Everything
Adds SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.77.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.77.2-postgres
└──▷ USE IT
Log in to Infisical using your identity provider identity provider A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
shell
copy
infisical login --sso
--sso flag in the CLI enables SSO authentication across all browsers and environments
1 detail in Everything
infisical-cli/v0.26.0 adds --verify-jwt and manual token fallback for browser login failures
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.26.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.26.0
Provides a manual token entry option when browser-based authentication fails
1 detail in Everything
infisical-cli v0.25.0 adds projectId support and switches secrets to raw format
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.25.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.25.0
└──▷ USE IT
Specify a project ID explicitly when setting a secret while already logged in.
shell
copy
infisical secrets set --projectId <project-id> --secret-key mykey --secret-value myvalue
Adds --projectId flag support when the user is logged in for the secrets set command
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! All secret endpoints now use the raw format instead of the previous encrypted storage method.
Adds manual user activation/deactivation via UI and IP whitelisting configuration
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.77.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.77.1-postgres
└──▷ HOW TO FIND IT
Manually reactivate a suspended user account directly from the interface.
📍 Navigate to User Page › Select user › Activate
infisical-cli v0.24.0 adds OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.24.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.24.0
oidc auth subcommand for CLI login via OpenID Connect OpenID Connect OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
1 detail in Everything
Adds AWS KMS AWS KMS AWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.77.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.77.0-postgres
Adds aws kms integration to manage encryption keys via AWS KMS KMS A managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. Adds new folder endpoints for Terraform providers Adds azure.auth.resourceUrl config option in the Kubernetes operator to customize the Azure authentication resource URL
3 details in Everything
Adds share-secret hide/unhide and soft deletes shared secrets upon expiry
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.76.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.76.1-postgres
└──▷ HOW TO FIND IT
Hides a shared secret from view in the UI while preserving it for API access or audit trails.
📍 In the Secrets Manager, select a shared secret and toggle Hide in the actions menu.
Unhides a previously hidden shared secret to restore full visibility.
📍 In the Secrets Manager, locate the hidden item in the Hidden filter and toggle Unhide .
Adds share-secret hide and unhide functionality for managed secrets. Performs a soft delete on shared_secrets when they reach their expiry date.
2 details in Everything
v0.76.0 adds OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.76.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.76.0-postgres
oidc machine identity authentication method is now available for service-to-service auth.Users can move secrets between folders via the Secrets > Move action in the UI or the POST /v1/secrets/:secretId/move API endpoint.
2 details in Everything
Adds admin_delete_users capability and token authentication method for identity workflows
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.75.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.75.0-postgres
Allows admins to delete users via the UI or API Introduces a Token Authentication Method alongside the revamped Identity (Page) workflow Displays a warning banner when deleting secrets in the fly.io integration
3 details in Everything
Adds secret sharing UI update, support for secret approval with groups, and a new Infisical Binary standalone core.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.74.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.74.0-postgres
Config added to .env or server config: SECRET_APPROVAL_GROUPS_ENABLED=true to enable secret approval workflows scoped by group membership.Shell binary: a new standalone executable named infisical-core replaces the previous infisical-standalone binary for local core deployments.
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The existing standalone binary is renamed from infisical-standalone to infisical-core. Any scripts or services invoking the old executable name will break and must be updated.
Native Slack webhook support for dynamic secrets; admin toggle for login options
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.73.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.73.1-postgres
Adds slack as a native dynamic secret type Allows toggling login options as an administrator
2 details in Everything
Infisical v0.73.0 adds org-level project favorites and backend validation for LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.73.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.73.0-postgres
└──▷ HOW TO FIND IT
Let team members pin their most frequently accessed projects to the top of the project list.
📍 In the Infisical web UI, navigate to a project card and click the Favorite icon (star).
Prevent misconfigured LDAP group mappings from being saved by ensuring the backend validates the group configuration before acceptance.
📍 Configure your LDAP integration via the Admin Settings › Authentication panel; the system will now reject invalid group configurations.
Adds the ability for organization members to mark projects as favorites via the UI. Adds a server-side validation check for LDAP group configurations.
2 details in Everything
infisical-cli/v0.23.3 adds --plain, --expand, and --include-imports flags to the secrets get subcommand for detailed secret retrieval.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.23.3 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.23.3
└──▷ TRY IT
Retrieve all secret dependencies for a specific key without variable interpolation or JSON wrapping, outputting raw values for direct consumption in scripts.
copy
$ infisical secrets get --include-imports --expand --plain my-secret-key
Adds --plain, --expand, and --include-imports options to infisical secrets get to control output formatting and dependency expansion
1 detail in Everything
Infisical v0.72.3 adds --plain CLI flag, LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.72.3-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.72.3-postgres
Adds support for configuring the unique attribute property for LDAP users via configuration key.
1 detail in Everything
v0.72.2-postgres adds project settings to rebuild secret indices and Terraform identity management APIs.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.72.2-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.72.2-postgres
feat: added project setting for rebuilding secret indices
1 detail in Everything
infisical/v0.72.1-postgres adds Certificate Support for Alt Names (SANs)
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.72.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.72.1-postgres
Infisical v0.72.0 introduces OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.72.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.72.0-postgres
feat: oidc adds OpenID Connect OpenID Connect OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Default organization slug configuration for LDAP/SAML setups via the new feature added in Feat: Default organization slug for LDAP/SAML
2 details in Everything
v0.71.0 adds public secret sharing, Certificate Management (PKI PKI A framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.71.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.71.0-postgres
└──▷ TRY IT
Log in using a specific authentication method via CLI
copy
$ infisical login --method <auth_method>
feat(k8-operator): reconcile on managed secret deletion enables the K8 operator to synchronize when a secret is deleted in Infisical.feat: handle import override in the API layer allows the API to process import override configurations for secrets.feat: added option for disabling github secret deletion introduces a setting to prevent secrets from being deleted in GitHub via integration.feat: add integration option to mask and protect gitlab secrets adds masking and protection options for GitLab secrets.New API endpoints PUT /tags/{id}, GET /tags/{id}, and GET /tags/slug/:slug for updating, getting by ID, and getting by slug.
+4 more
show less
feat(agent): Authentication methods exposes new authentication methods for the Infisical agent.feat(cli): Support for all authentication methods in infisical login command allows infisical login to use any configured auth method.Certificate Management (Internal PKI) enables issuing and managing internal certificates within Infisical. feat: allow sharing of secrets publicly + public page for secret sharing introduces the capability to share secrets via a public URL.
9 details in Everything
infisical-cli/v0.23.2 unifies CLI auth methods and adds raw secrets support
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.23.2 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.23.2
Adds --raw boolean flag to secrets commands (get, set, create, update) to return or input unescaped JSON strings. Removes redundant default auth schema logic; defaults explicitly to Bearer without requiring explicit config.
2 details in Everything
infisical-cli v0.23.1 adds login support for all auth methods
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.23.1 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.23.1
└──▷ USE IT
Authenticate using a username and password directly in non-interactive scripts.
shell
copy
infisical login --username <user> --password <pass>
Adds --password flag to the login command to enable password-based authentication
1 detail in Everything
Adds Feat(agent): Multiple auth methods allowing the CLI agent to authenticate via more than one mechanism
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.23.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.23.0
feat(agent): multiple auth methods allows configuring alternate authentication strategies for the Infisical agent
1 detail in Everything
Infisical v0.68.0 introduces secret sharing expiry on view count, Rundeck integration, and expanded K8s operator support for machine identity.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.68.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.68.0-postgres
└──▷ HOW TO FIND IT
Configure a secret share link that self-destructs after being viewed 3 times to limit exposure.
📍 Create a share link with max views set to 3 in the Infisical UI
Enable the Rundeck integration to automatically sync credentials from Infisical to your Rundeck instances.
📍 Go to Settings › Integrations › Enable Rundeck and configure your API token
Tag an existing AWS Parameter Store parameter directly within Infisical for better organization.
📍 Select the AWS parameter in the dashboard › Click Edit › Add tags under the Tags section
secret sharing supports expiry based on view count (after a specific number of views)New rundeck integration allowing Infisical secrets to sync with Rundeck K8s operator now includes imports for Machine Identity authentication K8s operator expands secret references capability with Machine Identity auth Existing AWS parameters can now be tagged within Infisical
5 details in Everything
infisical-cli v0.22.3 adds personal secrets creation and simplifies API domain handling.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.22.3 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.22.3
└──▷ USE IT
Configure the CLI to point to the correct Infisical backend without manual /api suffixes.
shell
copy
infisical config set --domain https://app.infisical.com
Adds personal-secrets subcommand to create secrets associated with the current user instead of a project Removes the need to append /api to the CLI domain when configuring or running commands
2 details in Everything
New secret sharing, personal secrets CLI support, and Azure native auth
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.66.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.66.0-postgres
personal_overrides applied during download to allow per-user secret value overridesCLI command infisical secret share enables direct sharing of secrets with other users Azure Native Authentication Method allows identity authentication without client secrets or certificates Support for configuring custom SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. CLI no longer requires passing /api in the domain URL (e.g., https://app.infisical.com works directly)
+1 more
show less
Personal secrets creation via CLI commands infisical secret add and infisical secret get with personal scope
6 details in Everything
Infisical v0.64.0 adds one-to-one AWS Secret Manager integration support and integration sync status tracking
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.64.0-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.64.0-postgres
Adds integration sync status visibility Makes Digital Ocean environment variables encrypted by default
2 details in Everything
Infisical v0.63.1 adds GCP, K8s, AWS native auth, audit streams, API secret expansion, and CLI export imports
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical/v0.63.1-postgres https://github.com/Infisical/infisical.git
$ git checkout infisical/v0.63.1-postgres
Adds gcp-native-auth as a supported authentication method for machine identities Adds kubernetes-native-auth as a supported authentication method for machine identities Enables audit log streaming via new audit log stream endpoints Adds ?expand=true query parameter to the secrets get API to resolve imported secrets recursively Adds --include-imports flag to the infisical export CLI command to include referenced secrets in output
+3 more
show less
Adds a secret-scanning disable option for workspace/project settings Adds imagePullSecrets support to the infisical-standalone-postgres Helm chart Adds workspace slug support in the Secret v3 Get Key API endpoint
8 details in Everything
infisical-cli/v0.21.0 adds --silent to suppress output, token renew, and Machine Identities support
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.21.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.21.0
└──▷ USE IT
Suppress output when exporting secrets to a variable or file for downstream consumption.
shell
copy
infisical export --path /prod --silent > secrets.env
Adds --silent flag to suppress command output for cleaner scripting. Introduces new token renew subcommand for refreshing access tokens access tokens A credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions.
2 details in Everything
Adds --recursive flag for deep secret search, dynamic secret agent templates, and re-trigger support
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.20.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.20.0
Adds infisical secrets list --recursive to support deep search across nested directories
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! The --deep parameter is renamed to --recursive in the CLI command
infisical-cli/v0.18.1 adds --value flag to secrets get for plain-text secret output
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.18.1 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.18.1
└──▷ TRY IT
Pipe the secret value directly into another CLI command or script without parsing JSON/structured output structured output Forcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed.
copy
$ infisical secrets get --path=/app/db --env=production --value
secrets get gains the --value flag to output only the secret value.The --value flag is now aliased as --raw-value.
2 details in Everything
infisical-cli v0.18.0 adds Agent secret referencing support
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.18.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.18.0
infisical-cli v0.17.2 adds orgName/displayName to /v1/workspace API and CLI prompts.
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.17.2 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.17.2
└──▷ TRY IT
Enrich workspace data with org details for display or routing.
copy
$ curl -H "Authorization: Bearer $INFS_TOKEN" 'https://api.infisical.com/v1/workspace?populateOrgName=true' Initialize a project in a specific organization context.
📍 infisical init
populateOrgName parameter added to /v1/workspace APICLI init command now asks for organization first, then projects Organization name displayed in infisical init output
3 details in Everything
└──▷ BREAKING ON UPGRADE
! INFISICAL_TOKEN_NAME variable name removed from CLI error messages (renamed to INFISICAL_DEFAULT_URL)
New infisical folders CLI commands for secret folder management
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.15.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.15.0
Adds the folders subcommand group to manage secret folders from the CLI Removes the previous requirement to use init for folder operations by decoupling it from the main workflow
2 details in Everything
Infisical CLI v0.9.0 adds Secret Reference feature for dynamic variable injection
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.9.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.9.0
Updates secret-ref handling logic to correctly process trailing slashes in reference paths
1 detail in Everything
infisical-cli/v0.8.0 adds interactive CLI login and browser-based authentication flows
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.8.0 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.8.0
Adds interactive login command to infisical-cli to authenticate users via terminal prompt. Adds support for cli login via browser to initiate an out-of-band authentication flow in the default web browser.
2 details in Everything
infisical-cli/v0.4.3 adds service token v2, offline fetch, explicit projectID export, multiple user profiles and FormatDotEnv export
└──▷ GET THIS VERSION
copy
$ git clone --branch infisical-cli/v0.4.3 https://github.com/Infisical/infisical.git
$ git checkout infisical-cli/v0.4.3
└──▷ USE IT
Export secrets in the new DotEnv format suitable for direct environment injection.
shell
copy
infisical export --format=FormatDotEnvExport
Adds --token flag to the export command to authenticate via a service token instead of a user session Adds FormatDotEnvExport as a new export format option for the export command
2 details in Everything
Infisical v0.4.2 introduces workspaces v3 endpoints for blind-index naming/labeling
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.4.2 https://github.com/Infisical/infisical.git
$ git checkout v0.4.2
GET endpoint for workspace-environment specific integration syncs to secrets v3, now with blind-index support
1 detail in Everything
Adds service account authentication, new Railway and Supabase integrations, CLI multi-profile support, and Vercel preview branch syncing.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.4.0 https://github.com/Infisical/infisical.git
$ git checkout v0.4.0
└──▷ USE IT
Switch between different Infisical CLI accounts without logging out.
shell
copy
infisical login --multi-profile
Configure a Kubernetes helm chart to authenticate using a service account token.
yaml
copy
secretsServiceToken: "your-service-token-here"
Enable automatic secret sync to Vercel preview deployments.
📍 # Configure in Infisical settings › Integrations › Vercel
# Select Preview Branches as the target environment
Adds --multi-profile flag to the Infisical CLI for managing multiple user accounts Adds service account as an auth method in the helm chart via secretsServiceToken config key Adds support for syncing secrets to Vercel preview branches automatically Adds Railway integration for service variables and environment syncing Adds Supabase integration with updated documentation and middleware support
5 details in Everything
v0.3.7 adds Azure Key Vault and GitLab group support, service tokens, RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.3.7 https://github.com/Infisical/infisical.git
$ git checkout v0.3.7
feat: disable update check option to suppress the default update notificationfeat(webui-localization): add dropdown option for spanish locale and corresponding locale filessupport for Azure Key Vault integration, including secret recovery for deleted secrets GitLab groups integration support with documented configuration infisical-node SDK supports service tokens for backend authentication
+5 more
show less
add rbac for config enabling role-based access control role-based access control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. add default jwt life time setting to control token expiration durationallow global defaults for secrets operator in the Kubernetes integrationpaginated Netlify sites support to handle larger site inventories efficientlynew emailConfigured field exposed via the status API endpoint
10 details in Everything
Infisical v0.3.6 adds Zoho email integration, Kubernetes integration support, and projectId export filtering
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.3.6 https://github.com/Infisical/infisical.git
$ git checkout v0.3.6
└──▷ USE IT
Export secrets from a specific project using the new explicit ID flag
shell
copy
infisical export --projectId <project-id>
Adds Zoho as a supported email provider for integrations Adds Kubernetes to the integrations list Allows exporting secrets by explicitly specifying projectId via the export command
3 details in Everything
Infisical v0.3.3 adds Travis CI integration and improves CLI search, default env, shell, and workspace handling
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.3.3 https://github.com/Infisical/infisical.git
$ git checkout v0.3.3
feat: search for workspace config in parent dir allows the Infisical CLI to locate configuration files in parent directories during execution.
1 detail in Everything
Infisical v0.3.0 adds CLI 2FA support, secrets auto-reload, and SocketLabs SMTP SMTP The application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.3.0 https://github.com/Infisical/infisical.git
$ git checkout v0.3.0
└──▷ USE IT
Secure your CLI login flow by enabling Two-Factor Authentication to prevent unauthorized access even if credentials are compromised.
shell
copy
infisical login --enable-2fa
Enable automatic reloading of secrets in your local environment to ensure running applications always have the latest values.
shell
copy
infisical watch --auto-reload true
Adds Two-Factor Authentication (2FA) capability to the CLI for enhanced account security. Introduces secrets auto reload feature, allowing dynamically updated environment variables without manual refresh or restart. Adds support for SocketLabs as an email SMTP provider in integrations.
3 details in Everything
Infisical v0.2.21 adds tags support to the secrets API and CLI, a workspace-memberships API endpoint, and CircleCI integration.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.21 https://github.com/Infisical/infisical.git
$ git checkout v0.2.21
Add tags query parameter to the secrets API for filtering results Add --tags flag to secrets-related Infisical CLI commands Introduce workspace-memberships API endpoint Enable disabling public sign-up via configuration
4 details in Everything
Infisical v0.2.19 adds AWS Parameter Store and Secrets Manager support, a reset command, and environment name validation.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.19 https://github.com/Infisical/infisical.git
$ git checkout v0.2.19
└──▷ TRY IT
Wipe local Infisical state to resolve corruption or start fresh.
aws_parameter_store_arn and aws_secret_manager_arn config keys for connecting to AWS secrets backendsinfisical reset subcommand for wiping local stateValidateEnvironmentName method added to the API/SDK
3 details in Everything
Infisical v0.2.18 adds Azure Key Vault integration, secret tagging, auto-capitalization toggle, and CLI env generation
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.18 https://github.com/Infisical/infisical.git
$ git checkout v0.2.18
└──▷ TRY IT
Generate a .env template for a project via CLI
copy
$ infisical gen-example-env Enable auto-capitalization for secret values in the user profile
📍 Settings › User Profile › Toggle Auto Capitalization
Attach metadata tags to a secret within the dashboard interface
📍 Dashboard › Secrets › Select Secret › Add Tags
Adds support for the Azure Key Vault integration to pull secrets from Azure Adds tags field to secrets, visible in the dashboard UI Adds an autoCapitalization toggle to user settings to control secret value casing Adds a new CLI command infisical gen-example-env to generate a sample .env file Adds a compare_secrets view in the dashboard to compare secrets across environments
5 details in Everything
v0.2.17 introduces offline secrets fetch, token flags for export and read commands, login/logout logs, and a new settings page.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.17 https://github.com/Infisical/infisical.git
$ git checkout v0.2.17
Adds offline flag to enable fetching secrets without an active network connection Adds --token flag to the export command for authenticated CLI exports Allows reading secrets directly using a service token via the read command with the --token flag Starts capturing login and logout events for auditing purposes Introduces a new settings page in the UI with updated global workspace and subscription context
5 details in Everything
v0.2.16 introduces the ability to change organizational roles
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.16 https://github.com/Infisical/infisical.git
$ git checkout v0.2.16
Adds the capability to change a role in an organization
1 detail in Everything
Adds api/get envs API denial, org-level basic auth model, and per-environment write permission status.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.9 https://github.com/Infisical/infisical.git
$ git checkout v0.2.9
Introduces a new basic authentication model for Organizations (Organization ), enabling alternative auth flows beyond SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Exposes a write permission status field in responses, allowing clients to check write capabilities without attempting mutations Allows editing personal permissions directly via the frontend, providing finer-grained control over user-specific access
3 details in Everything
v0.2.8 adds support for empty secret values and a new STRIPE_PRODUCT_TEAM environment variable.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.8 https://github.com/Infisical/infisical.git
$ git checkout v0.2.8
Adds Render and Fly.io integrations; renames INFISICAL_URL to API_URL
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.5 https://github.com/Infisical/infisical.git
$ git checkout v0.2.5
Adds explicit support for Render integration deployment targets Adds explicit support for Fly.io integration deployment targets
2 details in Everything
v0.2.4 adds MongoDB connection string support, upper-case environment names, custom Helm annotations and nodeport settings
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.4 https://github.com/Infisical/infisical.git
$ git checkout v0.2.4
Allow mongo connection string based on type Allowed upper case for environment names Add support for custom annotations to the helm chart Allow frontend service type overrides in helm chart Allow image overrides in helm chart
+1 more
show less
Allow setting of nodeport in helm chart
6 details in Everything
New API keys frontend and v2/secrets CURD endpoints; service token and k8-operator enhancements.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.3 https://github.com/Infisical/infisical.git
$ git checkout v0.2.3
└──▷ USE IT
Create a service token for a specific environment using the new slug-based identifier.
shell
copy
infisical service-token create --name "my-service" --env-slug production
9e55102 Switch to v2/secrets CURD api for cli updates the CLI to use the v2/secrets REST endpoints instead of the previous versioncf123d1 service token create - change env to slug modifies the service token creation logic to use a slug for environment identification63f22c5 add auto redeploy, new secrets api, and new service token enables automatic redeployment for services after secret updates via the new API surface
3 details in Everything
Infisical v0.2.2 adds SMTP SMTP The application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. AWS SES AWS SES Amazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.2 https://github.com/Infisical/infisical.git
$ git checkout v0.2.2
Adds smtp configuration options to enable AWS Simple Email Service (SES) for email delivery in Infisical.
1 detail in Everything
Infisical v0.2.1 adds secret versioning APIs, comments in exports/imports, service token scopes, and rollback endpoints.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.1 https://github.com/Infisical/infisical.git
$ git checkout v0.2.1
Adds the ability to export secrets with comments included in the output format Adds the ability to import secrets where comment fields are parsed and persisted
2 details in Everything
Infisical v0.2.0 adds batch CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.2.0 https://github.com/Infisical/infisical.git
$ git checkout v0.2.0
└──▷ TRY IT
Bulk import secrets into a workspace using the new batch API.
copy
$ curl -X POST https://app.infisical.com/api/v1/workspace/<workspaceId>/secrets/batchCreate \
-H "Authorization: Bearer $INFISICAL_TOKEN" \
-H "Content-Type: application/json" \
-d '[{"secretName": "db_password", "secretValue": "s3cret", "version": 1}]' Revoke an API key immediately using the new deletion endpoint.
copy
$ curl -X DELETE https://app.infisical.com/api/v1/apikey/<apiKeyId> \
-H "Authorization: Bearer $INFISICAL_TOKEN" Fetch secrets including their version history in the CLI using the new expand flag.
copy
$ infisical get --expand=true
Adds batchCreate and batchDelete API endpoints for secrets, enabling bulk creation and removal in a single call. Adds a DELETE /v1/apikey/{id} endpoint to revoke specific API keys. Adds expand=true flag to the CLI get command to retrieve secret versions alongside their values. Adds an activity log view displaying audit events such as pull actions, service token usage, and secret mutations.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The /v1/secret/:workspaceId route is migrated to /v2/workspace/:workspaceId/secrets, changing the endpoint path for v2 operations.
Infisical v0.1.16 adds secret versioning, project snapshots, and override support
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.1.16 https://github.com/Infisical/infisical.git
$ git checkout v0.1.16
Enables overrides for secrets in the dashboard, allowing version-specific values to take precedence.
1 detail in Everything
Adds --secret-override flag to the CLI for managing secret values
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.1.15 https://github.com/Infisical/infisical.git
$ git checkout v0.1.15
infisical now supports a new CLI option: the --secret-override flag for controlling secret value overrides.
1 detail in Everything
Infisical v0.1.12 adds GitHub integration frontend and yaml export support for service tokens
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.1.12 https://github.com/Infisical/infisical.git
$ git checkout v0.1.12
└──▷ USE IT
Export a service token in YAML format for easy reading by other config-aware tools.
shell
copy
infisical login --interactive && infisical service-tokens export <token_id> --format yaml
Configure a new GitHub integration to sync secrets, accessing the feature via the web console.
📍 In the Infisical dashboard, go to Integrations › GitHub and click Connect repository to start the OAuth flow.
Verify that the exported token includes the project ID by checking the YAML output fields.
shell
copy
infisical service-tokens export <token_id> --format yaml | grep 'project_id'
Adds yaml output format for exported service tokens via the --format flag or output configuration. Embeds project id into exported service tokens, enabling token-scoped resource access without additional context. Adds frontend UI for GitHub integration, allowing users to configure repository secrets directly from the console.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the GET /public-key route; clients must use the new method for retrieving public keys.
Infisical v0.1.11 adds Netlify and preliminary Vercel integrations plus chained CLI commands
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.1.11 https://github.com/Infisical/infisical.git
$ git checkout v0.1.11
Adds Netlify integration support to automate secret syncs for Netlify sites
1 detail in Everything
Infisical v0.1.8 adds an export CLI command for secret data and configurable notification timeouts.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.1.8 https://github.com/Infisical/infisical.git
$ git checkout v0.1.8
└──▷ USE IT
Export secrets from a specific environment to a CSV file for backup or migration.
shell
copy
infisical export --env production --format csv > secrets.csv
Adds the export subcommand to dump secrets from your workspace into a CSV file. Configurable timeout for toast notifications via the notificationTimeout setting.
2 details in Everything
Infisical v0.1.6 adds Helm chart support and framework integration docs for Django, Rails, Nuxt, Remix, Vue
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.1.6 https://github.com/Infisical/infisical.git
$ git checkout v0.1.6
└──▷ HOW TO FIND IT
Configure Django to use Infisical secrets by following the updated framework-specific guide.
📍 # Consult docs for Django integration instructions to set up middleware/config
Adds an installation option via Helm chart (add Helm chart), allowing deployment to Kubernetes environments Updates documentation with integration instructions for Django, Rails, Nuxt, Remix, and Vue frameworks
2 details in Everything
Infisical v0.1.5 adds --expand flag for environment variable expansion in CLI and secret generation settings.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.1.5 https://github.com/Infisical/infisical.git
$ git checkout v0.1.5
└──▷ USE IT
Run an application command with Infisical expanding variable references in the environment.
shell
copy
infisical run --expand -- node index.js
infisical run --expand enables environment variable substitution at runtimeAdds a secret generation setting to configure how secrets are created
2 details in Everything
Infisical v0.1.1 introduces a secret injection confirmation message and renames the --stage CLI flag to --env.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.1.1 https://github.com/Infisical/infisical.git
$ git checkout v0.1.1
Adds a helpful message displayed in logs to confirm that secrets are being injected Renames the --stage CLI flag to --env for environment selection
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The --stage CLI argument is replaced by --env in all CLI invocations.
Initial release of Infisical bringing frontend, backend, CLI, and open-source support.
└──▷ GET THIS VERSION
copy
$ git clone --branch v0.0.1 https://github.com/Infisical/infisical.git
$ git checkout v0.0.1
Provides a comprehensive suite including frontend, backend, and CLI for managing secrets Enables open-source deployment of Infisical for self-hosted secret management
2 details in Everything
docs update · Oct 2026
· source
Choose a badge style and copy the code →