Sessions

Time-bound grants that let AI agents access services without holding real credentials.

A session is a time-bound grant scoped to one access bundle. Infisical returns a session token that identifies the session, and the agent uses that token to authenticate to the proxy on every outbound request. The proxy then attaches the real credential from the matching service at the network boundary.

Every session is scoped to one access bundle and expires on a schedule you set. When the session expires (or you revoke it), the proxy stops attaching credentials to the agent’s requests within one poll interval.

Create a session

Anyone granted at least one access bundle can create a session. Admins can create one with any access bundle.

Dashboard

1. In Agent Vault, go to Sessions and select Create Session.

2. Pick the Access Bundle the agent should use, set a duration under Expires, then select Create Session.

   
3. Copy the command shown. The session token appears once and can’t be retrieved again.

   

Hand the copied command to whoever will start the agent. No Infisical login is needed on that machine.

CLI

infisical agent-vault run creates a session for you when you name the access bundle:

infisical agent-vault run --access-bundle <bundle-name> --proxy <proxy-address> -- <agent-command>

Set the duration with --ttl, which takes a value like 30m, 8h, 7d, or never.

The CLI creates the session as your user by default, or as a machine identity when you pass --client-id and --client-secret (or their environment variables). It revokes the session when the agent exits unless you pass --keep-session.

For an agent that runs unattended, set up the machine identity first: create it with Universal Auth, add it under Access Control, and grant it the access bundle.

Picking Never as the duration keeps the session working until someone revokes it. Only use this for long-running agents, and revoke the session once the agent has finished.

Revoke a session

To revoke a session before it expires, go to the Sessions page, open the session’s menu, and select Revoke Session. The proxy stops attaching credentials for the session within one poll interval.

The Sessions page shows each session as Active, Revoked, or Expired, and keeps expired and revoked sessions for 30 days so you can audit what an agent had access to during the session:

Access changes

The access bundle is chosen when you create the session and can’t be changed afterwards. However, the proxy re-checks whether the agent still gets credentials once every poll interval (60 seconds by default). Here’s how common access changes affect a session:

• If someone no longer has any grant on an access bundle, directly or through a group, their sessions for that bundle stop getting credentials
• If someone still has another grant on the bundle, such as through a group, revoking one grant doesn’t affect their sessions
• If you delete an access bundle, every session scoped to it stops getting credentials (the session still lists the bundle’s name, so you can see what it was)
• If you remove someone from Agent Vault, the proxy refuses every request on their sessions

If a session stops getting credentials because of a lost grant or a deleted bundle, the proxy still forwards the agent’s requests, without credentials. Whether those requests reach the upstream host depends on the proxy’s traffic policy.

Audit trail

When you create or revoke a session, Infisical writes an audit event. To review these events, open Audit Logs in Agent Vault, or scope an audit log stream to the Agent Vault product.