Built for machines,
not humans
Infisical under the hood. Hardened for the fyio ecosystem — per-app projects, machine identities, runtime injection, full audit trail. Nothing stored in the clear.
One project per app,
three environments each
Each fyio service — gofyio, payfyio, authfyio, kolaystack — gets its own Infisical project. Secrets are isolated: a leaked token in one app can never read secrets from another.
- ✓
dev / staging / productionenvironments per project - ✓Least-privilege service tokens — read-only by default
- ✓Namespace isolation — cross-project access denied at API level
- ✓Secret tagging, folders, and path-based organisation
Machine identities,
not human passwords
Universal Auth client IDs + secrets replace long-lived API keys. Each identity has a configured scope: which project, which environment, which paths. Tokens expire. Credentials rotate.
- ✓Client ID / secret pair per machine or service
- ✓Short-TTL access tokens — configurable expiry, auto-refresh
- ✓IP allowlisting for CI runners and k8s node IPs
- ✓Revoke any identity instantly from the dashboard
Secrets injected at
runtime — never at rest
Three injection paths depending on context: the Infisical CLI wraps any process, the k8s Operator syncs secrets into pod environment variables, and the SDK fetches on demand within application code.
- ✓
infisical run --wraps any binary — Node, Python, Go - ✓k8s Operator syncs secrets →
InfisicalSecretCRDs - ✓GitHub Actions integration for CI pipelines
- ✓
@envfyio/sdkfor in-process, on-demand fetching
Full audit trail,
version history, point-in-time
Every read, write, rotation, and identity authentication is logged with a timestamp and actor. Secret versions are kept indefinitely — roll back any secret to any previous value instantly.
- ✓Immutable audit log — who read what, when, from where
- ✓Full version history per secret — unlimited retention
- ✓Point-in-time recovery — restore any secret to any version
- ✓Access event webhooks — pipe to your SIEM or log aggregator
Never public.
Private by default.
envfyio runs on dev102 behind Tailscale. The secrets API is only reachable over the tailnet — not on the public internet. The web UI adds a second layer via Cloudflare Access with zero-trust identity verification.
- ✓Tailscale MagicDNS —
envfyio.internalonly on tailnet - ✓Cloudflare Access gate on the web dashboard
- ✓No public API surface — zero external attack surface
- ✓TLS everywhere — even inside the tailnet
pod / CI
tailnet
dev102
✓ Cloudflare Access · web UI
✓ TLS · end-to-end
Provider abstraction.
Swap backends later.
@envfyio/sdk wraps Infisical behind a stable provider interface.
App code calls secrets.get('KEY_NAME') — the backend can switch
from Infisical to OpenBao or another vault without touching application code.
- ✓Single
SecretsProviderinterface for all apps - ✓In-process caching with configurable TTL
- ✓TypeScript-first — full type inference on secret keys
- ✓Backend-agnostic — Infisical, OpenBao, env fallback for tests
Ready to eliminate plaintext secrets?
Open the dashboard to start creating projects, issuing machine identities, and injecting secrets at runtime.