Secrets managed.
Zero plaintext.
The single source of truth for API keys, env vars, and app secrets across the fyio ecosystem — gofyio, payfyio, authfyio, kolaystack and more. Machine identities, runtime injection, audit logs. Nothing stored in the clear.
per-app projects·dev / staging / production· k8s operator·CI injection·short-TTL tokens
Built for machines, not humans
Infisical is purpose-built for API keys, env vars, app secrets, teams, environments, and CI/CD. Vaultwarden handles human passwords. envfyio handles everything else.
Per-app Projects
Each fyio app gets its own Infisical project with dev / staging / production environments and least-privilege service tokens.
Machine Identities
Universal Auth client IDs/secrets with scoped access. Short-TTL tokens for k8s pods, CI runners, and app services — no long-lived credentials.
Runtime Injection
k8s Operator syncs secrets directly into pod envs. CLI infisical run wraps any process. GitHub Actions integration for CI pipelines.
Audit & Versioning
Every secret read, write, and rotation is logged. Full version history with point-in-time recovery. Know who accessed what and when.
Private by Default
Runs on dev102 behind Tailscale. Web UI gated by Cloudflare Access. The secrets API is never public — only accessible over the tailnet.
SDK Provider
A thin @envfyio/sdk wraps Infisical behind a provider interface. Swap to OpenBao later without touching app code.
From plaintext to zero-trust in four steps
Apps never store secrets in the repo or database. envfyio injects them at runtime — in k8s, CI, or CLI — from the single source of truth.
Create project
Each fyio app gets an Infisical project with dev / staging / production environments.
Issue identity
Generate a Machine Identity (Universal Auth) with scoped access. Short TTL, least privilege.
Inject at runtime
k8s Operator, infisical run CLI, or SDK fetches secrets into the process env — never written to disk.
Rotate & audit
Rotate secrets on schedule. Every access is logged. Point-in-time recovery for any secret version.
Leaving plaintext behind
Provider API keys in api_credentials table. Domain logins in domain_credentials. OpenAI key committed in .env.example. All of that goes away.
// should be encrypted.env.example