> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Infisical quickstarts

> Guides for the most common tasks in Infisical.

# Quickstarts

Guides for the most common tasks in Infisical, grouped by product area.

Jump to

[Secrets Management](#secrets-management)
[Certificate Management](#certificate-management)
[Privileged Access Management (PAM)](#privileged-access-management)
[Agent Vault](#agent-vault)
[Key Management Service (KMS)](#key-management)
[Secret Scanning](#secrets-scanning)

[Identity](#identity-and-access)
[Networking](#networking)
[Self-hosting](#self-hosting)
[API reference](#api-reference)

## [Secrets Management](https://infisical.com/docs/documentation/platform/secrets-mgmt/overview.md)

Store secrets in Infisical and deliver them to the applications and infrastructure that use them.

| Quickstart | Description |
| - | - |
| [Add your secrets to Infisical](https://infisical.com/docs/documentation/platform/secrets-mgmt/quick-starts/deliver-first-secret.md) | Store your secrets in Infisical and inject them into a running application. |
| [Run an app locally with secrets from Infisical](https://infisical.com/docs/documentation/guides/local-development.md) | Use the Infisical CLI to inject secrets into a locally running application. |
| [Inject secrets into a Docker container](https://infisical.com/docs/integrations/platforms/docker.md) | Deliver secrets from Infisical to a Docker container at startup. |
| [Inject secrets into a GitHub Actions workflow](https://infisical.com/docs/integrations/cicd/githubactions.md) | Fetch secrets from Infisical inside a GitHub Actions workflow at runtime. |
| [Sync secrets into Kubernetes](https://infisical.com/docs/documentation/guides/kubernetes-operator.md) | Use the Infisical Kubernetes Operator to pull secrets into a cluster. |
| [Rotate a PostgreSQL credential](https://infisical.com/docs/documentation/platform/secret-rotation/postgres-credentials.md) | Automatically replace a PostgreSQL credential on a schedule. |
| [Generate a short-lived PostgreSQL credential](https://infisical.com/docs/documentation/platform/dynamic-secrets/postgresql.md) | Generate a PostgreSQL credential on demand and revoke it after a short period. |

## [Certificate Management](https://infisical.com/docs/documentation/platform/pki/overview.md)

Issue and manage X.509 certificates through a private or public certificate authority.

| Quickstart | Description |
| - | - |
| [Issue your first certificate](https://infisical.com/docs/documentation/platform/pki/quick-starts/issue-first-certificate.md) | Set up a certificate authority and issue an X.509 certificate. |
| [Enroll certificates with ACME](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme) | Issue certificates to servers and workloads through the ACME protocol. |
| [Enroll a device with Microsoft Intune SCEP](https://infisical.com/docs/documentation/platform/pki/guides/applications/microsoft-intune-scep.md) | Push certificates to Intune-managed devices through SCEP. |

## [Privileged Access Management (PAM)](https://infisical.com/docs/documentation/platform/pam/overview.md)

Give users time-bound, audited access to databases and servers without sharing the underlying credential.

| Quickstart | Description |
| - | - |
| [Access a database or server through Infisical](https://infisical.com/docs/documentation/platform/pam/quick-starts/launch-first-session.md) | Open a session to a database or server without exposing the credential. |
| [Open an SSH session through Infisical](https://infisical.com/docs/documentation/platform/pam/accounts/ssh) | Reach a server over SSH without handing out the credential. |
| [Access a PostgreSQL database through Infisical](https://infisical.com/docs/documentation/platform/pam/accounts/postgresql.md) | Open a session to a PostgreSQL database without exposing the credential. |

## [Agent Vault](https://infisical.com/docs/documentation/platform/agent-vault/overview.md)

Let AI agents call third-party APIs through a proxy that attaches stored credentials on the way out, so the agent never sees them.

| Quickstart | Description |
| - | - |
| [Add your credentials to Agent Vault](https://infisical.com/docs/documentation/platform/agent-vault/quickstart.md) | Store your credentials in an access bundle and connect the agents that use them. |
| [Build an access bundle](https://infisical.com/docs/documentation/platform/agent-vault/access-bundles.md) | Define the set of services an agent session can reach. |
| [Add a service to an access bundle](https://infisical.com/docs/documentation/platform/agent-vault/services) | Store credentials for an external API the proxy will call on the agent's behalf. |

## [Key Management Service (KMS)](https://infisical.com/docs/documentation/platform/kms/overview.md)

Store cryptographic keys in Infisical and use them to encrypt, decrypt, and sign.

| Quickstart | Description |
| - | - |
| [Back Infisical KMS with an HSM](https://infisical.com/docs/self-hosting/guides/hsm-integration.md) | Use a hardware security module to protect the root key. |
| [Encrypt Kubernetes secrets with Infisical KMS](https://infisical.com/docs/documentation/platform/kms/kubernetes-encryption.md) | Use Infisical KMS as the encryption provider for Kubernetes secrets. |
| [Sign container images with Cosign](https://infisical.com/docs/documentation/platform/kms/sigstore-cosign.md) | Use a key from Infisical KMS to sign and verify container images with Cosign. |
| [Serve keys through KMIP](https://infisical.com/docs/documentation/platform/kms/kmip-server.md) | Expose keys from Infisical KMS to KMIP clients. |

## [Secret Scanning](https://infisical.com/docs/documentation/platform/secret-scanning/overview.md)

Detect credentials that have been committed to a source code repository.

| Quickstart | Description |
| - | - |
| [Scan a GitHub repository for leaked secrets](https://infisical.com/docs/documentation/platform/secret-scanning/github.md) | Connect a GitHub repository to Infisical and detect exposed credentials. |
| [Scan a GitLab repository for leaked secrets](https://infisical.com/docs/documentation/platform/secret-scanning/gitlab.md) | Connect a GitLab repository to Infisical and detect exposed credentials. |
| [Scan a Bitbucket repository for leaked secrets](https://infisical.com/docs/documentation/platform/secret-scanning/bitbucket.md) | Connect a Bitbucket repository to Infisical and detect exposed credentials. |

## [Identity and access](https://infisical.com/docs/documentation/platform/identities/overview.md)

Authenticate applications and users to Infisical.

| Quickstart | Description |
| - | - |
| [Authenticate a machine identity with universal auth](https://infisical.com/docs/documentation/platform/identities/universal-auth.md) | Configure universal auth so an application can authenticate with a client ID and secret. |
| [Authenticate a workload from Kubernetes](https://infisical.com/docs/documentation/platform/identities/kubernetes-auth.md) | Use a Kubernetes service account token to authenticate a workload with Infisical. |
| [Authenticate a workload with OIDC](https://infisical.com/docs/documentation/platform/identities/oidc-auth/general.md) | Use an OIDC identity token from a supported provider to authenticate a workload. |
| [Set up single sign-on](https://infisical.com/docs/documentation/platform/sso/overview.md) | Configure SSO through a supported identity provider. |

## [Networking](https://infisical.com/docs/documentation/platform/gateways/overview.md)

Reach systems that aren't on the public internet through a Gateway.

| Quickstart | Description |
| - | - |
| [Reach private systems with a Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) | Set up a Gateway to reach systems that aren't on the public internet. |
| [Deploy a Gateway](https://infisical.com/docs/documentation/platform/gateways/gateway-deployment.md) | Install and run a Gateway in your own infrastructure. |

## [Self-hosting](https://infisical.com/docs/self-hosting/overview.md)

Run Infisical on your own infrastructure.

| Quickstart | Description |
| - | - |
| [Self-host Infisical with Docker Compose](https://infisical.com/docs/self-hosting/deployment-options/docker-compose.md) | Run Infisical on your own infrastructure using Docker Compose. |
| [Self-host Infisical with the standalone Docker image](https://infisical.com/docs/self-hosting/deployment-options/standalone-infisical.md) | Run the frontend and backend from a single Docker image. |
| [Self-host Infisical on Kubernetes with Helm](https://infisical.com/docs/self-hosting/deployment-options/kubernetes-helm.md) | Deploy Infisical to a Kubernetes cluster with the Helm chart. |
| [Self-host Infisical on AWS with ECS Fargate](https://infisical.com/docs/self-hosting/deployment-options/aws-native.md) | Deploy Infisical on AWS using ECS Fargate, RDS, and ElastiCache. |
| [Self-host Infisical on GCP with GKE](https://infisical.com/docs/self-hosting/deployment-options/gcp-native.md) | Deploy Infisical on GCP using GKE, Cloud SQL, and Memorystore. |
| [Install Infisical from the Linux package](https://infisical.com/docs/self-hosting/deployment-options/native/linux-package/installation.md) | Install Infisical directly on a Linux host with the native package. |

## [API reference](https://infisical.com/docs/api-reference/overview/introduction.md)

Programmatically manage resources over HTTPS with the Infisical REST API.

| Quickstart | Description |
| - | - |
| [Make your first authenticated API request](https://infisical.com/docs/api-reference/overview/quickstart.md) | Create a machine identity, authenticate with Universal Auth, and call the Infisical API. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.