infisical-secret-rotation
Guide for configuring Infisical Secret Rotation — automatically rotating credentials that already exist in a third-party system on a fixed interval, writing the new values back into Infisical secrets. Covers all 28 rotation providers (PostgreSQL, MySQL, MSSQL, OracleDB, MongoDB, Redis, AWS IAM user secrets, Azure/Okta/Auth0 client secrets, LDAP passwords, Unix/Linux and Windows local accounts, Cloudflare, Datadog, Snowflake key pairs, OpenAI/OpenRouter/LiteLLM/Fireworks API keys, and more), the dual-phase vs single-phase rotation models, rotation intervals and rotateAtUtc scheduling, parameters and secretsMapping, and the two-user pattern for SQL databases. Use this skill when someone asks about: secret rotation, rotating credentials, automatic credential rotation, rotating a database password on a schedule, expiring API keys, rotationInterval, or 'how do I rotate my database password automatically'. For changing an EXISTING credential on a timer. Not for creating brand-new ephemeral c
- Installs
- 155
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/infisical/ai-skills --skill infisical-secret-rotation- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads infisical-secret-rotation automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Infisical Secret Rotation Guide
You are a setup assistant helping users configure Infisical Secret Rotation — a feature that periodically replaces credentials in a third-party system and writes the new values into Infisical secrets, so applications reading those secrets always get a working credential.
Not this skill
Secret Rotation is routinely confused with two other features. Route correctly before answering:
| If the user wants... | Use |
|---|---|
| A new, ephemeral credential minted per request, auto-revoked at lease expiry | infisical-dynamic-secrets — not this skill |
| An existing, long-lived credential replaced on a schedule, staying at a stable secret path | this skill |
| To push Infisical secrets out to a third-party service | infisical-secret-syncs |
| To create the App Connection a rotation depends on | infisical-app-connections |
| Rotating a privileged/human account with session recording and checkout | infisical-pam |
The distinction that matters most:
- Dynamic secret — Infisical creates a brand-new short-lived user on demand. Every consumer gets a different credential. Nothing exists until you ask.
- Secret rotation — the account already exists and you own it. Infisical changes its credential on a timer and updates the secret in place. Every consumer reads the same secret path.
If the user says "I want temporary credentials per CI job," that is dynamic secrets. If they say "our Postgres password hasn't changed in two years," that is rotation.
How to use this skill
- Confirm rotation is the right feature (see the table above)
- App Connection — every rotation authenticates through one; it must exist first
- Provider — pick the rotation type
- Parameters — provider-specific, and for SQL the two-user setup
- Secrets mapping — which Infisical secret names receive the rotated values
- Schedule —
rotationInterval(days) androtateAtUtc - Rotation model — confirm whether this provider is dual-phase or single-phase, because it changes the operational advice
Reference files
| File | When to read |
|---|---|
references/rotation-overview.md | How rotation works, dual-phase vs single-phase, scheduling, the full provider list, API shape |
references/sql-databases.md | PostgreSQL, MySQL, MSSQL, OracleDB, MongoDB, Redis — including the mandatory two-user pattern |
references/cloud-and-saas.md | AWS IAM, Azure, Okta, Auth0, Cloudflare, Datadog, Snowflake, Databricks, Supabase, LLM provider keys |
references/machine-accounts.md | LDAP passwords, Unix/Linux local accounts, Windows local accounts, HP iLO — all single-phase |
Guiding principles
- App Connection first. A rotation cannot be created without one, and its type is fixed per rotation provider (a PostgreSQL rotation requires a
postgresconnection, not a generic one). Seeinfisical-app-connections. - SQL rotations need two pre-existing users. This is the single most common setup failure. Infisical alternates between
username1andusername2; both accounts must already exist with identical grants. Infisical does not create them. - Establish dual-phase vs single-phase before advising. For the five single-phase providers, old credentials die the instant rotation happens. Recommend disabling auto-rotation and rotating in a maintenance window.
rotationIntervalis in days, minimum 1. Not hours, not a cron string.- Applications must re-read the secret. Rotation updates the secret in Infisical; it does not restart anything. Pair with the Infisical Agent's
execute.command, the Kubernetes Operator's reload behavior, or an app that re-reads on a timer. - Never generate the credentials yourself. Infisical generates rotated values. Do not invent passwords for the user, and never print secret values.
- Dual-phase gives a grace period, not immortality. A credential set stays valid for one extra interval after being replaced. If an app caches a secret for longer than 2× the interval, it will eventually authenticate with a revoked credential.
FAQ
What does the infisical-secret-rotation skill do?
Guide for configuring Infisical Secret Rotation — automatically rotating credentials that already exist in a third-party system on a fixed interval, writing the new values back into Infisical secrets. Covers all 28 rotation providers (PostgreSQL, MySQL, MSSQL, OracleDB, MongoDB, Redis, AWS IAM user secrets, Azure/Okta/Auth0 client secrets, LDAP passwords, Unix/Linux and Windows local accounts, Cloudflare, Datadog, Snowflake key pairs, OpenAI/OpenRouter/LiteLLM/Fireworks API keys, and more), the dual-phase vs single-phase rotation models, rotation intervals and rotateAtUtc scheduling, parameters and secretsMapping, and the two-user pattern for SQL databases. Use this skill when someone asks about: secret rotation, rotating credentials, automatic credential rotation, rotating a database password on a schedule, expiring API keys, rotationInterval, or 'how do I rotate my database password automatically'. For changing an EXISTING credential on a timer. Not for creating brand-new ephemeral c
How do I install infisical-secret-rotation?
Run npx skills add https://github.com/infisical/ai-skills --skill infisical-secret-rotation in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/infisical-secret-rotation/ (personal) or .claude/skills/infisical-secret-rotation/ (project).
Which AI agents can use infisical-secret-rotation?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is infisical-secret-rotation safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains infisical-secret-rotation?
It is published by infisical in infisical/ai-skills. It has 155 recorded installs.
More from infisical/ai-skills
infisical-api
infisical/ai-skills
Interact with the Infisical REST API to manage secrets, projects, environments, machine identities, and more. Supports secret CRUD operations, machine identity authentication, pagination, and rate limiting on cloud deployments. Not for the CLI/SDKs (infisical-setup), KMS crypto endpoints (infisical-kms), certificate endpoints (infisical-pki), or human SSO login (infisical-sso).
infisical-secret-syncs
infisical/ai-skills
Guide for configuring Infisical Secret Syncs to push secrets from Infisical to third-party services. Covers all 48 sync destinations including AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub, Vercel, HashiCorp Vault, Cloudflare, Snowflake, Databricks, Railway, and more. Use this skill when someone asks about: syncing secrets to AWS/GCP/Azure, pushing secrets to GitHub Actions, Vercel environment variables, secret sync setup, App Connections, mapping behavior, key schemas, initial sync behavior, or 'how do I get my Infisical secrets into [service]'. Not for creating the required App Connection (infisical-app-connections), pulling secrets into an app (infisical-setup), syncing certificates (infisical-pki PKI Syncs), or rotating a credential (infisical-secret-rotation).
infisical-user-setup-guide
infisical/ai-skills
Interactive setup guide for using Infisical as a secret management tool in your projects. Helps users integrate Infisical into local development (CLI), Docker containers (build-time and runtime secret injection), CI/CD pipelines (GitHub Actions, GitLab CI), Kubernetes (Operator + CRDs), and application code (all 9 SDKs: Node.js, Python, Go, Java, .NET, Ruby, PHP, Rust, C++). Also walks through choosing and configuring any of the 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE). Use this skill whenever someone asks about: using Infisical, injecting secrets, infisical run, infisical init, connecting their app to Infisical, Docker secrets, Kubernetes secrets operator, machine identity setup, SDK initialization, CI/CD secret injection, or 'how do I get my secrets into my app'. Not for the Kubernetes Operator CRDs (infisical-kubernetes-operator), rendering secrets to files (infisical-agent), pushing secrets ou
infisical-agent
infisical/ai-skills
Guide for configuring the Infisical Agent — a client daemon that manages token lifecycle and renders secrets via Go templates without modifying application code. Covers the full YAML config format, all 6 agent auth methods (universal-auth, kubernetes, aws-iam, azure, gcp-id-token, gcp-iam), sinks, template functions (listSecrets, listSecretsByProjectSlug, getSecretByName, dynamicSecret), polling, on-change commands, retry strategy, and persistent caching. Use this skill when someone asks about: Infisical Agent, agent config file, agent templates, rendering secrets to files, sidecar secret injection, init container secrets, token renewal, infisical agent command, or 'how do I use the Infisical Agent to inject secrets'. Not for Kubernetes Secrets or ConfigMaps managed by a controller (infisical-kubernetes-operator), nor infisical run (infisical-setup).
infisical-dynamic-secrets
infisical/ai-skills
Guide for configuring Infisical Dynamic Secrets — on-demand, short-lived credentials for databases, cloud IAM, SSH, and Kubernetes. Covers all 30 providers including PostgreSQL, MySQL, MSSQL, Oracle, Redis, AWS ElastiCache, AWS MemoryDB, MongoDB, Elasticsearch, Couchbase, Milvus, AWS IAM, GCP IAM, Azure Entra ID, SSH certificates, Kubernetes service accounts, LDAP, GitHub, Tailscale, IBM API Connect, and TOTP. Use this skill when someone asks about: dynamic secrets, ephemeral database credentials, short-lived tokens, rotating database users, dynamic PostgreSQL/MySQL/Redis credentials, SSH certificates, temporary AWS IAM users, lease renewal, or 'how do I generate temporary credentials with Infisical'. For brand-new short-lived credentials created per request. Not for changing an existing credential on a schedule (infisical-secret-rotation), nor for recorded human/agent access without a credential (infisical-pam). Covers SSH certificates; TLS certificates are infisical-pki.
infisical-self-host
infisical/ai-skills
Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTIONKEY management, PostgreSQL setup, Redis configuration (including the required noeviction policy), production hardening, FIPS 140-3 compliance, scaling, and high availability patterns. For deploying the Infisical platform itself. Not for the Kubernetes Operator, which is a separate Helm chart (infisical-kubernetes-operator), nor for using Infisical once running (infisical-setup).
Popular data & databases skills
supabase-postgres-best-practices
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pgcron, pgmq), vector/semantic search (pgvector), and restoring dumps (pgrestore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.
prisma-client-api
prisma/skills
Prisma Client API reference covering model queries, filters, operators, and client methods. Use when writing database queries, using CRUD operations, filtering data, or configuring Prisma Client. Triggers on "prisma query", "findMany", "create", "update", "delete", "$transaction".
prisma-database-setup
prisma/skills
Deprecated compatibility name for prisma-orm-setup. Use only when a user or existing integration explicitly invokes prisma-database-setup; otherwise select prisma-orm-setup.
prisma-cli
prisma/skills
Prisma ORM 7 CLI reference for existing Prisma 7 applications or explicitly selected Prisma 7 workflows. Covers prisma init, generate, migrate, db, dev, studio, and mcp. For setup, connection repair, or Prisma 8, use prisma-orm-setup; not the Prisma Platform CLI.
prisma-postgres
prisma/skills
Deprecated compatibility name for prisma-postgres-setup. Use only when a user or existing integration explicitly invokes prisma-postgres; otherwise select prisma-postgres-setup.
prisma-driver-adapter-implementation
prisma/skills
Required reference for Prisma ORM 7 SQL driver adapter work. Use when implementing or modifying adapters, adding database drivers, or touching SqlDriverAdapter, Transaction, savepoint, result mapping, or DriverAdapterError behavior. Covers current transaction lifecycle, optional savepoint hooks, original database-error preservation, and verification.