Read how to configure environment variables for self-hosted Infisical.
Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI and REDIS_URL must be defined.
However, you can configure additional settings to activate more features as needed.
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
Use the command below to encode your certificate:
echo "<certificate>" | base64
Without email configuration, Infisical’s core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.
Create an account and configure SendGrid to send emails.
Create a SendGrid API Key under Settings > API Keys
Set a name for your API Key, we recommend using “Infisical,” and select the “Restricted Key” option. You will need to enable the “Mail Send” permission as shown below:
With the API Key, you can now set your SMTP environment variables:
Copy
Ask AI
SMTP_HOST=smtp.sendgrid.netSMTP_USERNAME=apikeySMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step aboveSMTP_PORT=587SMTP_SECURE=trueSMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
Create an account and configure Mailgun to send emails.
Obtain your Mailgun credentials in Sending > Overview > SMTP
With your Mailgun credentials, you can now set up your SMTP environment variables:
Copy
Ask AI
SMTP_HOST=smtp.mailgun.org # obtained from credentials pageSMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials pageSMTP_PASSWORD=password # obtained from credentials pageSMTP_PORT=587SMTP_SECURE=trueSMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
1
Create a verifed identity
This will be used to verify the email you are sending from.
If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies.
2
Create an account and configure AWS SES
Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentials
3
Set up your SMTP environment variables
With your AWS SES SMTP credentials, you can now set up your SMTP environment variables for your Infisical instance.
Copy
Ask AI
SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settingsSMTP_USERNAME=xxx # your SMTP usernameSMTP_PASSWORD=xxx # your SMTP passwordSMTP_PORT=587SMTP_SECURE=falseSMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
Create an account and configure SocketLabs to send emails.
From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
Copy
Ask AI
SMTP_HOST=smtp.socketlabs.comSMTP_USERNAME=username # obtained from your credentialsSMTP_PASSWORD=password # obtained from your credentialsSMTP_PORT=587SMTP_SECURE=trueSMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
The SMTP_FROM_ADDRESS environment variable should be an email for an
authenticated domain under Configuration > Domain Management in SocketLabs.
For example, if you’re using SocketLabs in sandbox mode, then you may use an
email like team@sandbox.socketlabs.dev.
Remember that you will need to restart Infisical for this to work properly.
With the API Key, you can now set your SMTP environment variables variables:
Copy
Ask AI
SMTP_HOST=smtp.resend.comSMTP_USERNAME=resendSMTP_PASSWORD=YOUR_API_KEYSMTP_PORT=587SMTP_SECURE=trueSMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
Create an account and enable “less secure app access” in Gmail Account Settings > Security. This will allow
applications like Infisical to authenticate with Gmail via your username and password.
With your Gmail username and password, you can set your SMTP environment variables:
Copy
Ask AI
SMTP_HOST=smtp.gmail.comSMTP_USERNAME=hey@gmail.com # your emailSMTP_PASSWORD=password # your passwordSMTP_PORT=587SMTP_SECURE=trueSMTP_FROM_ADDRESS=hey@gmail.comSMTP_FROM_NAME=Infisical
As per the notice by Google, you should note that using Gmail credentials for SMTP configuration
will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.
Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
Create an account and configure Office365 to send emails.
With your login credentials, you can now set up your SMTP environment variables:
Copy
Ask AI
SMTP_HOST=smtp.office365.comSMTP_USERNAME=username@yourdomain.com # your usernameSMTP_PASSWORD=password # your passwordSMTP_PORT=587SMTP_SECURE=trueSMTP_FROM_ADDRESS=username@yourdomain.comSMTP_FROM_NAME=Infisical
Create an account and configure Zoho Mail to send emails.
With your email credentials, you can now set up your SMTP environment variables:
Copy
Ask AI
SMTP_HOST=smtp.zoho.comSMTP_USERNAME=username # your emailSMTP_PASSWORD=password # your passwordSMTP_PORT=587SMTP_SECURE=trueSMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho MailSMTP_FROM_NAME=Infisical
You can use either your personal Zoho email address like you@zohomail.com or
a domain-based email address like you@yourdomain.com. If using a
domain-based email address, then please make sure that you’ve configured and
verified it with Zoho Mail.
Remember that you will need to restart Infisical for this to work properly.
By default, users can only login via email/password based login method.
To login into Infisical with OAuth providers such as Google, configure the associated variables.
