Skip to main content

​
What is a Dynamic Secret?

A dynamic secret is a time-bound credential generated on demand for a specific user or system. Unlike static secrets, which are created and stored ahead of time, or rotated credentials, which are periodically replaced, dynamic secrets don’t exist until they’re requested — and automatically expire shortly after use. Each secret is unique to the identity that requested it, reducing the risk of reuse, long-term exposure, or accidental leaks. Because they are short-lived and tightly scoped, dynamic secrets are well suited for high-security environments, automated systems, and ephemeral workloads where access needs to be both temporary and auditable. By limiting the lifespan and visibility of credentials, dynamic secrets offer a strong alternative to managing long-lived secrets manually.

​
Dynamic Secrets in Infisical

Infisical generates dynamic secrets in real time when a user or machine identity requests access. Each secret is uniquely scoped to the requesting identity, valid just-in-time only for a limited duration, and automatically revoked after it expires. Because they are short-lived and identity-specific, dynamic secrets reduce the risk of credential reuse, accidental exposure, or long-term persistence across environments. When supported for a given integration, using dynamic secrets is strongly recommended. Infisical currently supports dynamic secret templates for commonly used systems including PostgreSQL, MySQL, Microsoft SQL Server, MongoDB Atlas, Redis, AWS IAM, GCP IAM, Azure Entra ID, and more. To learn more, refer to the dynamic secrets documentation.