Gabriel Brown
89761a7da3
Agent instructions, skills, SSH host aliases and expansion triggers are worth having identical on every machine one person owns, and belong in none of the shared configuration. They live in user/ now, with a manifest saying where each piece goes and a link-user stage that puts it there. That stage does nothing unless the machine said yes. Somebody who clones Panama to try the desktop keeps their own ~/.claude/CLAUDE.md exactly where it was; the question names the destinations and defaults to no. Anything displaced goes to config/old rather than being deleted. ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md were byte-identical copies of one file, which is the drift this exists to prevent. Also adds the vitals toggles for the battery and Claude usage readouts, which had preferences and no way to reach them.
3.1 KiB
Dynamic Secrets Overview
What are Dynamic Secrets?
Dynamic secrets are credentials generated on-demand upon access rather than stored statically. Each credential is:
- Unique to the identity requesting it
- Short-lived with a configurable TTL
- Automatically revocable when the lease expires
- Auditable with full traceability of who accessed what and when
Core Concepts
Lease Lifecycle
- Generate — User or application requests a new lease with a specific TTL
- Use — Credentials are active until the lease expires
- Renew — Extend the lease TTL (cannot exceed the Max TTL defined on the dynamic secret)
- Revoke — Manually delete the lease before TTL expiration, or let it auto-expire
TTL Settings
Every dynamic secret has two TTL settings:
- Default TTL — The default duration when generating a new lease (e.g.,
1h,30m) - Max TTL — The absolute ceiling — leases cannot be renewed past this point (e.g.,
24h,7d)
Supported Providers (27)
SQL Databases: PostgreSQL, MySQL, MSSQL, Oracle, SAP ASE, SAP HANA, Snowflake, Vertica, ClickHouse, Azure SQL Database
NoSQL & Cache: Redis, MongoDB, MongoDB Atlas, Elasticsearch, Couchbase, Cassandra, RabbitMQ
Cloud IAM: AWS IAM (users + temporary credentials), GCP IAM (service account tokens), Azure Entra ID
Infrastructure: SSH Certificates, Kubernetes Service Account Tokens, LDAP, GitHub (tokens), TOTP
Common Setup Pattern
- Open Secret Overview Dashboard → Select environment
- Click "Add Dynamic Secret"
- Select provider (e.g., SQL Database, Redis, AWS IAM, SSH)
- Configure:
- Secret Name
- Default TTL and Max TTL
- Provider-specific connection details (host, port, credentials)
- Optional: Custom creation/revocation statements
- Optional: Gateway for private network access
- Submit — Dynamic secret appears in dashboard
- Generate Lease — Click the dynamic secret → "New Lease" → specify TTL
Gateway for Private Networks
If your database or resource is in a VPC, private subnet, or behind a firewall with no public endpoint, you need an Infisical Gateway.
- Gateway is a lightweight service deployed in your private network
- It makes only outbound connections (no inbound firewall rules needed)
- Routes traffic through a relay server using SSH reverse tunnels
- Enterprise feature (Cloud Enterprise tier or self-hosted Enterprise license)
- One gateway per network/region/isolated environment
Configure the gateway when creating the dynamic secret — select it from the Gateway dropdown.
Using Dynamic Secrets Programmatically
Via Infisical Agent Templates
{{ with dynamicSecret "my-project" "dev" "/" "postgres-creds" "1h" }}
DB_USER={{ .DB_USERNAME }}
DB_PASS={{ .DB_PASSWORD }}
{{ end }}
The agent automatically renews leases before expiration.
Via API
Use the Infisical API to create, renew, and revoke leases programmatically. Authenticate with a machine identity access token.
Via SDKs
Infisical SDKs support dynamic secret lease creation. Check the SDK docs for your language.