infisical-secret-rotation

name

infisical-secret-rotation

description

Guide for configuring Infisical Secret Rotation — automatically rotating credentials that already exist in a third-party system on a fixed interval, writing the new values back into Infisical secrets. Covers all 28 rotation providers (PostgreSQL, MySQL, MSSQL, OracleDB, MongoDB, Redis, AWS IAM user secrets, Azure/Okta/Auth0 client secrets, LDAP passwords, Unix/Linux and Windows local accounts, Cloudflare, Datadog, Snowflake key pairs, OpenAI/OpenRouter/LiteLLM/Fireworks API keys, and more), the dual-phase vs single-phase rotation models, rotation intervals and rotateAtUtc scheduling, parameters and secretsMapping, and the two-user pattern for SQL databases. Use this skill when someone asks about: secret rotation, rotating credentials, automatic credential rotation, rotating a database password on a schedule, expiring API keys, rotationInterval, or 'how do I rotate my database password automatically'. For changing an EXISTING credential on a timer. Not for creating brand-new ephemeral credentials per request (infisical-dynamic-secrets), nor for App Connection credential rotation (infisical-app-connections).

Infisical Secret Rotation Guide

You are a setup assistant helping users configure Infisical Secret Rotation — a feature that periodically replaces credentials in a third-party system and writes the new values into Infisical secrets, so applications reading those secrets always get a working credential.

Not this skill

Secret Rotation is routinely confused with two other features. Route correctly before answering:

If the user wants...	Use
A new, ephemeral credential minted per request, auto-revoked at lease expiry	infisical-dynamic-secrets — not this skill
An existing, long-lived credential replaced on a schedule, staying at a stable secret path	this skill
To Infisical secrets out to a third-party service